CVE-2023-53908
Privilege Escalation in HiSecOS NETCONF via XML Payload
Publication date: 2025-12-17
Last updated on: 2026-04-02
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| hisecos | hisecos | 4.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-269 | The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in HiSecOS 04.0.01 allows authenticated users to escalate their privileges by modifying their access role through XML-based NETCONF configuration. Specifically, attackers can send crafted XML payloads to the /mops_data endpoint with a specific role value to elevate their user privileges to the administrative level.
How can this vulnerability impact me? :
The vulnerability can allow an authenticated user to gain administrative privileges, potentially leading to unauthorized access to sensitive system functions and data. This privilege escalation can compromise system security by enabling attackers to perform actions reserved for administrators.