Read the docs
TI-2020-05642 Aliases CVE-2020-6994GHSA-299q-28qj-ch6v

Buffer overflow in Hirschmann Automation and Control GmbH, a division of Belden Inc. HiOS…

Priority MEDIUM 45CWE-12Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.

Summary

A buffer overflow vulnerability was found in some devices of Hirschmann Automation and Control HiOS and HiSecOS. The vulnerability is due to improper parsing of URL arguments. An attacker could exploit this vulnerability by specially crafting HTTP requests to overflow an internal buffer. The following devices using HiOS Version 07.0.02 and lower are affected: RSP, RSPE, RSPS, RSPL, MSP, EES, EES, EESX, GRS, OS, RED. The following devices using HiSecOS Version 03.2.00 and lower are affected: EAGLE20/30.

Why it matters now

EPSS 0.01646 76th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Hirschmann Automation and Control GmbH, a division of Belden Inc.HiOS for the following devices RSP, RSPE, RSPS, RSPL, MSP, EES, EES, EESX, GRS, OS, REDup to 07.0.02—No fix listedCNA
Hirschmann Automation and Control GmbH, a division of Belden Inc.HiSecOS for device EAGLE20/30up to 03.2.00—No fix listedCNA
  • HiOS for the following devices RSP, RSPE, RSPS, RSPL, MSP, EES, EES, EESX, GRS, OS, RED VendorHirschmann Automation and Control GmbH, a division of Belden Inc. Affected up to 07.0.02 Fixed in — No fix listed CNA
  • HiSecOS for device EAGLE20/30 VendorHirschmann Automation and Control GmbH, a division of Belden Inc. Affected up to 03.2.00 Fixed in — No fix listed CNA

CPE configurations NVD · 14

CPEVersionsRoleVendor
cpe:2.3:o:belden:hirschmann_hios:*:*:*:*:*:*:*:*up to 07.0.02VulnerableBelden
cpe:2.3:h:belden:hirschmann_embedded_ethernet_switch:-:*:*:*:*:*:*:*not specified by NVDRunning onBelden
cpe:2.3:h:belden:hirschmann_embedded_ethernet_switch_extended:-:*:*:*:*:*:*:*not specified by NVDRunning onBelden
cpe:2.3:h:belden:hirschmann_greyhound_swtich:-:*:*:*:*:*:*:*not specified by NVDRunning onBelden
cpe:2.3:h:belden:hirschmann_mice_switch_power:-:*:*:*:*:*:*:*not specified by NVDRunning onBelden
cpe:2.3:h:belden:hirschmann_octopus:-:*:*:*:*:*:*:*not specified by NVDRunning onBelden
cpe:2.3:h:belden:hirschmann_prp_redbox:-:*:*:*:*:*:*:*not specified by NVDRunning onBelden
cpe:2.3:h:belden:hirschmann_rail_switch_power:-:*:*:*:*:*:*:*not specified by NVDRunning onBelden
cpe:2.3:h:belden:hirschmann_rail_switch_power_enhanced:-:*:*:*:*:*:*:*not specified by NVDRunning onBelden
cpe:2.3:h:belden:hirschmann_rail_switch_power_lite:-:*:*:*:*:*:*:*not specified by NVDRunning onBelden
  • cpe:2.3:o:belden:hirschmann_hios:*:*:*:*:*:*:*:* Versions up to 07.0.02 Vulnerable ·Belden
  • cpe:2.3:h:belden:hirschmann_embedded_ethernet_switch:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
  • cpe:2.3:h:belden:hirschmann_embedded_ethernet_switch_extended:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
  • cpe:2.3:h:belden:hirschmann_greyhound_swtich:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
  • cpe:2.3:h:belden:hirschmann_mice_switch_power:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
  • cpe:2.3:h:belden:hirschmann_octopus:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
  • cpe:2.3:h:belden:hirschmann_prp_redbox:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
  • cpe:2.3:h:belden:hirschmann_rail_switch_power:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
  • cpe:2.3:h:belden:hirschmann_rail_switch_power_enhanced:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
  • cpe:2.3:h:belden:hirschmann_rail_switch_power_lite:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
Show 4 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:belden:hirschmann_rail_switch_power_smart:-:*:*:*:*:*:*:*not specified by NVDRunning onBelden
cpe:2.3:o:belden:hirschmann_hisecos:*:*:*:*:*:*:*:*up to 03.2.00VulnerableBelden
cpe:2.3:h:belden:hirschmann_eagle20:-:*:*:*:*:*:*:*not specified by NVDRunning onBelden
cpe:2.3:h:belden:hirschmann_eagle30:-:*:*:*:*:*:*:*not specified by NVDRunning onBelden
  • cpe:2.3:h:belden:hirschmann_rail_switch_power_smart:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
  • cpe:2.3:o:belden:hirschmann_hisecos:*:*:*:*:*:*:*:* Versions up to 03.2.00 Vulnerable ·Belden
  • cpe:2.3:h:belden:hirschmann_eagle20:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden
  • cpe:2.3:h:belden:hirschmann_eagle30:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Belden

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-6994
  2. 2026-10-03 Alias added: GHSA-299q-28qj-ch6v

References

Advisory 1

  • TI-2019-09143 Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). CVSS 3.1CRITICAL 9.8
  • TI-2019-09145 Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component. CVSS 3.1HIGH 8.8
  • TI-2019-09144 Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component. CVSS 3.1CRITICAL 9.8
  • TI-2019-09148 Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4). CVSS 3.1CRITICAL 9.8
  • TI-2019-09153 Wind River VxWorks 6.5, 6.6, 6.7, 6.8, 6.9.3 and 6.9.4 has a Memory Leak in the IGMPv3… CVSS 3.1MEDIUM 5.3
  • TI-2019-09149 Wind River VxWorks 6.7 though 6.9 and vx7 has a Buffer Overflow in the TCP component… CVSS 3.1CRITICAL 9.8
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences