PT-2026-30262 · Undefined · Undefined

Published 2026-04-03 · Updated 2026-04-03 · CVE-2018-25236

NVD

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Hirschmann HiOS and HiSecOS products RSP, RSPE, RSPS, RSPL, MSP, EES, EESX, GRS, OS, RED, EAGLE contain an authentication bypass vulnerability in the HTTP(S) management module that allows unauthenticated remote attackers to gain administrative access by crafting specially formed HTTP requests. Attackers can exploit improper authentication handling to obtain the authentication status and privileges of a previously authenticated user without providing valid credentials.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2018-25236

Affected Products

Undefined

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-25236 · Security Note
• https://vulncheck.com/advisories/hirschmann-hios-hisecos-authentication-bypass-via-http-management · Note
• https://assets.belden.com/m/52ecadbb5f1b0e04/original/Security-Bulletin-Web-Server-Authentication-Bypass-HiOS-HiSecOS-Hirschmann-BSECV-2018-05.pdf · Note