CVE-2025-15620

Analyzed Analyzed - Analysis Complete

Denial-of-Service in HiOS Switch Web Interface Causes Reboot

Publication date: 2026-04-02

Last updated on: 2026-06-05

Assigner: VulnCheck

Description

HiOS Switch Platform versions 09.1.00 through 09.4.04 and 10.0.00 through 10.3.00 contain a denial-of-service vulnerability in the web interface that allows remote attackers to reboot the affected device by sending a malicious HTTP GET request to a specific endpoint. Attackers can trigger an uncontrolled reboot condition through crafted HTTP requests to cause service disruption and unavailability of the switch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-04-02

Last Modified

2026-06-05

Generated

2026-07-06

AI Q&A

2026-04-03

EPSS Evaluated

2026-07-05

NVD

CVE-2025-15620

Affected Vendors & Products

Vendor	Product	Version / Range
belden	hios_switch	From 09.1.00 (inc) to 09.4.05 (exc)
belden	hios_switch	From 10.0.00 (inc) to 10.3.01 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

The vulnerability exists in the HiOS Switch Platform's web interface, where a remote attacker can send a specially crafted HTTP GET request to a specific endpoint.

This malicious request causes the affected device to reboot uncontrollably, leading to a denial-of-service condition.

In other words, an attacker can disrupt the normal operation of the switch by forcing it to restart repeatedly through these crafted HTTP requests.

Impact Analysis

This vulnerability can cause service disruption and unavailability of the affected switch device.

Since the device can be remotely rebooted repeatedly by an attacker, network services relying on the switch may experience downtime.

This can impact network reliability, availability of critical services, and potentially lead to operational interruptions.

Hi! I’m here to help you understand CVE-2025-15620. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70