Read the docs
TI-2026-60334 Aliases CVE-2026-89025GHSA-f972-wg3c-28j6

Hirschmann HiOS Switch Platform DoS via Malformed HTTP Request

Priority MEDIUM 45CWE-755Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Hirschmann HiOS Switch Platform devices contain a denial-of-service vulnerability in the integrated web server due to missing validation of HTTP(S) content. A remote unauthenticated attacker can send a specially crafted HTTP(S) request to a specific endpoint that is processed incorrectly, causing the device to perform an unintended reboot and resulting in a temporary denial-of-service condition. This vulnerability has been addressed in versions 07.1.12, 08.7.10, 09.0.13, 09.3.03, 10.3.08, and 10.5.00.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0077 55th percentileScored 2026-11-07
Fix Fixed Hirschmann HiOS Switch Platform (Belden): 07.1.12, 08.7.10, 09.0.13 +2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
BeldenHirschmann HiOS Switch Platform07.0.0 – 07.1.11; 08.0.0 – 08.7.09; 09.0.00 – 09.0.12; 09.3.00 – 09.3.02; 10.0.0 – 10.3.07; 10.4.00; 10.5.0007.1.12, 08.7.10, 09.0.13, 09.3.03, 10.3.08Patch availableCNA
  • Hirschmann HiOS Switch Platform VendorBelden Affected 07.0.0 – 07.1.11; 08.0.0 – 08.7.09; 09.0.00 – 09.0.12; 09.3.00 – 09.3.02; 10.0.0 – 10.3.07; 10.4.00; 10.5.00 Fixed in 07.1.12, 08.7.10, 09.0.13, 09.3.03, 10.3.08 Patch available CNA

Remediation

  • Fix · CNA Hirschmann HiOS Switch Platform (Belden) Fixed in 07.1.12, 08.7.10, 09.0.13, 09.3.03, 10.3.08

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-89025
  2. 2026-10-03 Alias added: GHSA-f972-wg3c-28j6

References

Patch 1

  • TI-2019-09143 Wind River VxWorks has a Buffer Overflow in the TCP component (issue 1 of 4). CVSS 3.1CRITICAL 9.8
  • TI-2019-09145 Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component. CVSS 3.1HIGH 8.8
  • TI-2022-19123 The web server of Hirschmann BAT-C2 before 09.13.01.00R04 allows authenticated command… CVSS 3.1HIGH 8.8
  • TI-2019-09144 Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the IPv4 component. CVSS 3.1CRITICAL 9.8
  • TI-2019-09148 Wind River VxWorks 6.9 and vx7 has a Buffer Overflow in the TCP component (issue 2 of 4). CVSS 3.1CRITICAL 9.8
  • TI-2025-43113 A stored cross-site scripting (XSS) vulnerability exists in the web management interface… CVSS 3.1MEDIUM 6.1
See all 49 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences