TI-2018-15461 Aliases CVE-2018-25236 GHSA-9hhf-w3pr-8g2c

Hirschmann HiOS HiSecOS Authentication Bypass via HTTP Management

MEDIUM 49CWE-287Published 2026-04-03 · Updated 2026-07-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-287.

Summary

Hirschmann HiOS and HiSecOS products RSP, RSPE, RSPS, RSPL, MSP, EES, EESX, GRS, OS, RED, EAGLE contain an authentication bypass vulnerability in the HTTP(S) management module that allows unauthenticated remote attackers to gain administrative access by crafting specially formed HTTP requests. Attackers can exploit improper authentication handling to obtain the authentication status and privileges of a previously authenticated user without providing valid credentials.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00521 44th percentileScored 2026-11-07

Fix Fixed Hirschmann HiOS (Belden): 06.1.05, 07.0.00, 03.1.00Hirschmann HiSecOS EAGLE (Belden): 03.0.03

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Belden	Hirschmann HiOS	up to 05.07; up to 06.1.04; up to 06.2.00	06.1.05, 07.0.00, 03.1.00	Patch available	CNA
Belden	Hirschmann HiSecOS EAGLE	up to 03.00.02	03.0.03	Patch available	CNA

Hirschmann HiOS VendorBelden Affected up to 05.07; up to 06.1.04; up to 06.2.00 Fixed in 06.1.05, 07.0.00, 03.1.00 Patch available CNA
Hirschmann HiSecOS EAGLE VendorBelden Affected up to 03.00.02 Fixed in 03.0.03 Patch available CNA

Remediation

Fix · CNA Hirschmann HiOS (Belden) Fixed in 06.1.05, 07.0.00, 03.1.00
Fix · CNA Hirschmann HiSecOS EAGLE (Belden) Fixed in 03.0.03

Timeline

2026-10-02 Threatist record created from CVE-2018-25236
2026-10-03 Alias added: GHSA-9hhf-w3pr-8g2c

References

Advisory 1

https://assets.belden.com/m/52ecadbb5f1b0e04/original/Security-Bulletin-Web-Server-Authentication-Bypass-HiOS-HiSecOS-Hirschmann-BSECV-2018-05.pdf

TI-2019-09143 Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). CVSS 3.1CRITICAL 9.8
TI-2019-09145 Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component. CVSS 3.1HIGH 8.8
TI-2022-19123 The web server of Hirschmann BAT-C2 before 09.13.01.00R04 allows authenticated command… CVSS 3.1HIGH 8.8
TI-2019-09144 Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component. CVSS 3.1CRITICAL 9.8
TI-2019-09148 Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4). CVSS 3.1CRITICAL 9.8
TI-2025-43113 A stored cross-site scripting (XSS) vulnerability exists in the web management interface… CVSS 3.1MEDIUM 6.1

See all 49 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences