PT-2026-29894 · Unknown · Hios Switch Platform

Published 2026-04-02 · Updated 2026-04-03 · CVE-2025-15620

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions HiOS Switch Platform versions 09.1.00 through 09.4.04 and version 10.3.01.

Description The HiOS Switch Platform contains a denial-of-service issue in the web interface. Remote attackers can reboot the affected device by sending a malicious HTTP GET request to a specific endpoint. Attackers can trigger an uncontrolled reboot condition through crafted HTTP requests, causing service disruption and unavailability of the switch.

Recommendations Versions 09.1.00 through 09.4.04 should be updated to version 09.4.05 or later. Version 10.3.01 should be updated to a later version.

Fix

DoS

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2025-15620

Affected Products

Hios Switch Platform

References · 7

• https://assets.belden.com/m/702a656e81736b04/original/PSIRT-2_Web_Interface_HiOS.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-15620 · Security Note
• https://twitter.com/0dayPublishing/status/2039804920149225762 · Twitter Post
• https://vulncheck.com/advisories/hios-switch-platform-denial-of-service-via-web-interface · Note
• https://twitter.com/CVEnew/status/2040128758229659696 · Twitter Post
• https://twitter.com/TheHackerWire/status/2039900812777078864 · Twitter Post
• https://twitter.com/CveFindCom/status/2039828616402403560 · Twitter Post