Hirschmann Industrial HiVision Improper Authorization Privilege Escalation
Priority LOW 31CWE-285Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-285.
Summary
Hirschmann Industrial HiVision versions 06.0.00 and 07.0.00 prior to 06.0.06 and 07.0.01 contains an improper authorization vulnerability that allows read-only users to gain write access to managed devices by bypassing access control mechanisms. Attackers can exploit alternative interfaces such as the web interface or SNMP browser to modify device configurations despite having restricted permissions.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00246 15th percentileScored 2026-11-07
Fix Fixed Hirschmann Industrial HiVision (Belden): 06.0.06, 07.0.01
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Belden | Hirschmann Industrial HiVision | 06.0.00 – 06.0.05; 07.0.00 to before 07.0.01 | 06.0.06, 07.0.01 | Patch available | CNA |
- Hirschmann Industrial HiVision VendorBelden Affected 06.0.00 – 06.0.05; 07.0.00 to before 07.0.01 Fixed in 06.0.06, 07.0.01 Patch available CNA
Remediation
- Fix · CNA Hirschmann Industrial HiVision (Belden) Fixed in 06.0.06, 07.0.01
Timeline
- 2026-10-02 Threatist record created from CVE-2017-20238
- 2026-10-03 Alias added: GHSA-j2fr-26h3-2878
- 2026-10-29 Affected versions changed · CNA
References
More Belden vulnerabilities
- TI-2019-09143 Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). CVSS 3.1CRITICAL 9.8
- TI-2019-09145 Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component. CVSS 3.1HIGH 8.8
- TI-2022-19123 The web server of Hirschmann BAT-C2 before 09.13.01.00R04 allows authenticated command… CVSS 3.1HIGH 8.8
- TI-2019-09144 Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component. CVSS 3.1CRITICAL 9.8
- TI-2019-09148 Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4). CVSS 3.1CRITICAL 9.8
- TI-2025-43113 A stored cross-site scripting (XSS) vulnerability exists in the web management interface… CVSS 3.1MEDIUM 6.1
Sources
- CVE-2017-20238 · CVE Program
- CVE-2017-20238 · NVD
- FIRST EPSS
- GHSA-j2fr-26h3-2878 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences