Executive Summary

This vulnerability exists in Hirschmann HiOS and HiSecOS products' HTTP(S) management module. It is an authentication bypass flaw that allows unauthenticated remote attackers to gain administrative access by sending specially crafted HTTP requests.

The issue arises from improper authentication handling, enabling attackers to obtain the authentication status and privileges of a previously authenticated user without needing valid credentials.

Useful 0 Not Useful 0

Impact Analysis

An attacker exploiting this vulnerability can gain administrative access to affected Hirschmann devices remotely without authentication.

This can lead to unauthorized control over the device, potentially allowing the attacker to change configurations, disrupt network operations, or access sensitive information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated remote attackers to gain administrative access by bypassing authentication in Hirschmann HiOS and HiSecOS products. Such unauthorized access can lead to exposure, modification, or deletion of sensitive data.

As a result, organizations using affected products may face challenges in maintaining compliance with common standards and regulations such as GDPR and HIPAA, which require strict access controls and protection of sensitive information.

Failure to prevent unauthorized administrative access could lead to data breaches, potentially violating data protection requirements and resulting in legal and financial consequences.

Useful 0 Not Useful 0