by Kastro
Paper/Archive/CVE-2024-14034

CVE-2024-14034

Belden Hirschmann HiEOS LRS11 — Hirschmann HiEOS Authentication Bypass via HTTP Management Module

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
37
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 40.2.402 × 208.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Hirschmann HiEOS devices versions prior to 01.1.00 contain an authentication bypass vulnerability in the HTTP(S) management module that allows unauthenticated remote attackers to gain administrative access by sending specially crafted HTTP(S) requests. Attackers can exploit improper authentication handling to obtain elevated privileges and perform unauthorized actions including configuration download or upload and firmware modification.

Affected

ProductAffectedFixed inSource
Hirschmann HiEOS LRS11< 01.1.0001.1.00CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisoryassets.belden.com/m/7ec5c6da25ef288/original/Belden_Security_Bulletin_BSECV-2024-02_1v0.pdfwriteupvulncheck.com/advisories/hirschmann-hieos-authentication-bypass-via-http-management-module