Hirschmann Hios Switch Platform
Monthly
Remote unauthenticated attackers can force Hirschmann HiOS industrial switches to reboot by sending a specially crafted HTTP(S) request to a specific endpoint of the device's integrated web server, causing a temporary denial of service. Affected units are those running HiOS versions prior to the fixes released in 07.1.12, 08.7.10, 09.0.13, 09.3.03, 10.3.08 and 10.5.00. No public exploit code or in-the-wild exploitation has been identified at time of analysis, but the flaw is trivially reachable over the network (CVSS 4.0 base 8.7, AV:N/PR:N/UI:N) against any switch whose management interface is exposed.
Remote denial-of-service in Belden Hirschmann HiOS Switch Platform allows unauthenticated attackers to reboot switches via crafted HTTP GET requests to the web interface. Affects versions 9.1.00-9.4.05 and 10.0.00-10.3.01. Exploitation requires no authentication (PR:N) and low complexity (AC:L), enabling trivial service disruption of network infrastructure. CVSS 9.2 (critical) reflects high availability impact on both vulnerable component and subsequent systems. No public exploit identified at time of analysis, though the attack vector is straightforward HTTP-based.
Remote unauthenticated attackers can force Hirschmann HiOS industrial switches to reboot by sending a specially crafted HTTP(S) request to a specific endpoint of the device's integrated web server, causing a temporary denial of service. Affected units are those running HiOS versions prior to the fixes released in 07.1.12, 08.7.10, 09.0.13, 09.3.03, 10.3.08 and 10.5.00. No public exploit code or in-the-wild exploitation has been identified at time of analysis, but the flaw is trivially reachable over the network (CVSS 4.0 base 8.7, AV:N/PR:N/UI:N) against any switch whose management interface is exposed.
Remote denial-of-service in Belden Hirschmann HiOS Switch Platform allows unauthenticated attackers to reboot switches via crafted HTTP GET requests to the web interface. Affects versions 9.1.00-9.4.05 and 10.0.00-10.3.01. Exploitation requires no authentication (PR:N) and low complexity (AC:L), enabling trivial service disruption of network infrastructure. CVSS 9.2 (critical) reflects high availability impact on both vulnerable component and subsequent systems. No public exploit identified at time of analysis, though the attack vector is straightforward HTTP-based.