PT-2026-30245 · Undefined · Undefined

CVE-2015-10148 · Published 2026-04-03 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Hirschmann HiLCOS OpenBAT, WLC, BAT300, BAT54 versions prior to 8.80 Hirschmann HiLCOS OpenBAT versions prior to 9.10

Description Devices are shipped with identical default SSH and SSL keys that cannot be changed. This allows unauthenticated remote attackers to decrypt or intercept encrypted management communications. By leveraging these shared default cryptographic keys across multiple devices, attackers can perform man-in-the-middle attacks, impersonate devices, and expose sensitive information.

Recommendations Update HiLCOS OpenBAT, WLC, and BAT300, BAT54 to version 8.80 or later. Update HiLCOS OpenBAT to version 9.10 or later.

Fix

Weakness Enumeration

CWE-321

Related Identifiers

CVE-2015-10148

Affected Products

Undefined

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2015-10148 · Security Note
• https://vulncheck.com/advisories/hirschmann-hilcos-hard-coded-credentials-ssh-ssl-keys · Note
• https://t.me/cveNotify/208447 · Telegram Post
• https://assets.belden.com/m/76d31798e65c9f47/original/Security-Bulletin-SSH-SSL-Default-Keys-HiLCOS-Hirschmann-BSECV-2015-12.pdf · Note