PT-2026-30245 · Undefined · Undefined

Published 2026-04-03 · Updated 2026-04-03 · CVE-2015-10148

NVD

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Hirschmann HiLCOS devices OpenBAT, WLC, BAT300, BAT54 prior to 8.80 and OpenBAT prior to 9.10 are shipped with identical default SSH and SSL keys that cannot be changed, allowing unauthenticated remote attackers to decrypt or intercept encrypted management communications. Attackers can perform man-in-the-middle attacks, impersonate devices, and expose sensitive information by leveraging the shared default cryptographic keys across multiple devices.

Fix

Weakness Enumeration

CWE-321

Related Identifiers

CVE-2015-10148

Affected Products

Undefined

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2015-10148 · Security Note
• https://vulncheck.com/advisories/hirschmann-hilcos-hard-coded-credentials-ssh-ssl-keys · Note
• https://assets.belden.com/m/76d31798e65c9f47/original/Security-Bulletin-SSH-SSL-Default-Keys-HiLCOS-Hirschmann-BSECV-2015-12.pdf · Note