Description (CNA)
Hirschmann HiOS and HiSecOS products RSP, RSPE, RSPS, RSPL, MSP, EES, EESX, GRS, OS, RED, EAGLE contain an authentication bypass vulnerability in the HTTP(S) management module that allows unauthenticated remote attackers to gain administrative access by crafting specially formed HTTP requests. Attackers can exploit improper authentication handling to obtain the authentication status and privileges of a previously authenticated user without providing valid credentials.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Belden / Hirschmann HiOS | affected 0 through 05.07; affected 0 through 06.1.04; affected 0 through 06.2.00; unaffected 06.1.05; unaffected 07.0.00; unaffected 03.1.00 |
| Belden / Hirschmann HiSecOS EAGLE | affected 0 through 03.00.02; unaffected 03.0.03 |
CWE
CWE-287
References
- https://assets.belden.com/m/52ecadbb5f1b0e04/original/Security-Bulletin-Web-Server-Authentication-Bypass-HiOS-HiSecOS-Hirschmann-BSECV-2018-05.pdf
- https://www.vulncheck.com/advisories/hirschmann-hios-hisecos-authentication-bypass-via-http-management
ADP enrichment
No English description supplied.
No references supplied.