CVE-2018-25236 | Hirschmann HiOS and HiSecOS products RSP, RSPE, RSPS, RSPL, … | CVSS 9.8 CRITICAL

Description

Hirschmann HiOS and HiSecOS products RSP, RSPE, RSPS, RSPL, MSP, EES, EESX, GRS, OS, RED, EAGLE contain an authentication bypass vulnerability in the HTTP(S) management module that allows unauthenticated remote attackers to gain administrative access by crafting specially formed HTTP requests. Attackers can exploit improper authentication handling to obtain the authentication status and privileges of a previously authenticated user without providing valid credentials.

Metadata

CVE ID: CVE-2018-25236
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-04-03 17:10 UTC
Published: 2026-04-03 22:44 UTC
Last updated: 2026-07-15 01:23 UTC
Primary CWE: CWE-287
Improper Authentication (CWE-287)
Vendor / Product: Belden / Hirschmann HiOS
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (2)

Vendor	Product	Platform	Versions
Belden	Hirschmann HiOS	—	0 ≤ 05.07, 0 ≤ 06.1.04, 0 ≤ 06.2.00, 06.1.05 …
Belden	Hirschmann HiSecOS EAGLE	—	0 ≤ 03.00.02, 03.0.03

Weakness (CWE)

CWE	Source	Description
CWE-287	cna	Improper Authentication (CWE-287)

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (2)