CVE-2015-10148
Default SSH/SSL Keys in Hirschmann HiLCOS Enable MITM Attacks
Publication date: 2026-04-03
Last updated on: 2026-04-03
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| hirschmann | hilcos | to 8.80 (exc) |
| hirschmann | openbat | to 9.10 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-321 | The product uses a hard-coded, unchangeable cryptographic key. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects Hirschmann HiLCOS devices OpenBAT, WLC, BAT300, BAT54 prior to version 8.80 and OpenBAT prior to version 9.10. These devices are shipped with identical default SSH and SSL keys that cannot be changed.
Because the cryptographic keys are shared and unchangeable across multiple devices, unauthenticated remote attackers can exploit this to decrypt or intercept encrypted management communications.
Attackers can perform man-in-the-middle attacks, impersonate devices, and expose sensitive information by leveraging these shared default keys.
How can this vulnerability impact me? :
This vulnerability can have serious security impacts including:
- Allowing attackers to decrypt or intercept encrypted management communications.
- Enabling man-in-the-middle attacks where attackers can intercept or alter communications.
- Allowing attackers to impersonate legitimate devices, potentially gaining unauthorized access.
- Exposing sensitive information managed by the affected devices.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows unauthenticated remote attackers to decrypt or intercept encrypted management communications by exploiting identical default SSH and SSL keys that cannot be changed. Such exposure of sensitive information and the ability to perform man-in-the-middle attacks can lead to violations of data protection and privacy requirements mandated by common standards and regulations like GDPR and HIPAA.
Specifically, the compromise of encrypted communications and potential exposure of sensitive data may result in non-compliance with confidentiality and integrity requirements, increasing the risk of regulatory penalties and loss of trust.