CVE-2024-14034 | Hirschmann HiEOS devices versions prior to 01.1.00 contain a… | CVSS 9.8 CRITICAL

Description

Hirschmann HiEOS devices versions prior to 01.1.00 contain an authentication bypass vulnerability in the HTTP(S) management module that allows unauthenticated remote attackers to gain administrative access by sending specially crafted HTTP(S) requests. Attackers can exploit improper authentication handling to obtain elevated privileges and perform unauthorized actions including configuration download or upload and firmware modification.

Metadata

CVE ID: CVE-2024-14034
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-04-01 21:21 UTC
Published: 2026-04-02 20:01 UTC
Last updated: 2026-05-14 02:07 UTC
Primary CWE: CWE-287
Improper Authentication (CWE-287)
Vendor / Product: Belden / Hirschmann HiEOS LRS11
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
Belden	Hirschmann HiEOS LRS11	—	0 < 01.1.00

Weakness (CWE)

CWE	Source	Description
CWE-287	cna	Improper Authentication (CWE-287)

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (2)