CVE-2017-20237 | Hirschmann Industrial HiVision versions prior to 06.0.07 and… | CVSS 9.8 CRITICAL

Description

Hirschmann Industrial HiVision versions prior to 06.0.07 and 07.0.03 contains an authentication bypass vulnerability in the master service that allows unauthenticated remote attackers to execute arbitrary commands with administrative privileges. Attackers can invoke exposed interface methods over the remote service to bypass authentication and achieve remote code execution on the underlying operating system.

Metadata

CVE ID: CVE-2017-20237
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-04-03 19:47 UTC
Published: 2026-04-03 21:05 UTC
Last updated: 2026-05-14 02:06 UTC
Primary CWE: CWE-287
Improper Authentication (CWE-287)
Vendor / Product: Belden / Hirschmann Industrial HiVision
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Belden	Hirschmann Industrial HiVision	—	0 ≤ 06.0.06, 0 ≤ 07.0.02, 06.0.07, 07.0.03

Weakness (CWE)

CWE	Source	Description
CWE-287	cna	Improper Authentication (CWE-287)

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (2)