17
CVEs
6
Critical
9
High
0
KEV
0
PoC
13
Unpatched C/H
11.8%
Patch Rate
0.0%
Avg EPSS
Severity Breakdown
CRITICAL
6
HIGH
9
MEDIUM
2
LOW
0
Monthly CVE Trend
Affected Products (30)
Hirschmann Hios
14
Ruggedcom Win7018 Firmware
11
Ruggedcom Win7025 Firmware
11
Vxworks
11
Ruggedcom Win7200 Firmware
11
Windriver
11
Ruggedcom Win7000 Firmware
11
Garrettcom Magnum Dx940E Firmware
11
Sonicos
9
Siprotec 5 Firmware
9
E Series Santricity Os Controller
8
Power Meter 9810 Firmware
7
Power Meter 9410 Firmware
7
Hirschmann Rsb20 0900S2Tttaab
5
Hirschmann Octopus Os3X Xx24Xxx
5
Hirschmann Mach104 16Tx Poep 2X R
5
Hirschmann M1 8Mm Sc
5
Hirschmann Mach104 16Tx Poep R L3P
5
Hirschmann Rsb20 0800T1T1Saab
5
Hirschmann Rsb20 0900Zzz6Saab
5
Hirschmann Mach4002 48G 3X L2P
5
Hirschmann Octopus Os24 081000T5T5Tneuhb
5
Hirschmann Rsb20 0900Zzz6Taab
5
Hirschmann Mach102 24Tp Fr
5
Hirschmann Octopus Os20 000900T5T5Tafbhh
5
Hirschmann M1 8Tp Rj45
5
Hirschmann Mach104 16Tx Poep 2X R L3P
5
Hirschmann Rsb20 0800M2M2Taabe
5
Hirschmann Rsb20 0900Mmm2Taab
5
Hirschmann Mach104 16Tx Poep 2X E L3P
5
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2018-25237 | Hirschmann HiSecOS devices versions prior to 05.3.03 contain a buffer overflow vulnerability in the HTTPS login interface when RADIUS authentication is enabled that allows remote attackers to crash. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.3 | 0.1% | 47 |
No patch
|
| CVE-2017-20234 | GarrettCom Magnum 6K and 10K managed switches contain an authentication bypass vulnerability that allows unauthenticated attackers to gain unauthorized access by exploiting a hardcoded string in the. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.3 | 0.0% | 47 |
No patch
|
| CVE-2018-25236 | Hirschmann HiOS and HiSecOS products RSP, RSPE, RSPS, RSPL, MSP, EES, EESX, GRS, OS, RED, EAGLE contain an authentication bypass vulnerability in the HTTP(S) management module that allows. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.3 | 0.0% | 47 |
No patch
|
| CVE-2024-14034 | Hirschmann HiEOS devices contain an authentication bypass vulnerability in the HTTP(S) management module that allows unauthenticated remote attackers to gain administrative access by sending. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improper Authentication vulnerability could allow attackers to bypass authentication mechanisms to gain unauthorized access. | CRITICAL | 9.3 | 0.0% | 47 |
|
| CVE-2021-4477 | Hirschmann HiLCOS OpenBAT and BAT450 products contain a firewall bypass vulnerability in IPv6 IPsec deployments that allows traffic from VPN connections to bypass configured firewall rules. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | CRITICAL | 9.3 | 0.0% | 47 |
No patch
|
| CVE-2025-15620 | Remote denial-of-service in Belden Hirschmann HiOS Switch Platform allows unauthenticated attackers to reboot switches via crafted HTTP GET requests to the web interface. Affects versions 9.1.00-9.4.05 and 10.0.00-10.3.01. Exploitation requires no authentication (PR:N) and low complexity (AC:L), enabling trivial service disruption of network infrastructure. CVSS 9.2 (critical) reflects high availability impact on both vulnerable component and subsequent systems. No public exploit identified at time of analysis, though the attack vector is straightforward HTTP-based. | CRITICAL | 9.2 | 0.0% | 46 |
No patch
|
| CVE-2015-10148 | Hirschmann HiLCOS devices OpenBAT, WLC, BAT300, BAT54 prior to 8.80 and OpenBAT prior to 9.10 are shipped with identical default SSH and SSL keys that cannot be changed, allowing unauthenticated. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | HIGH | 8.8 | 0.0% | 44 |
No patch
|
| CVE-2020-37216 | Hirschmann Industrial HiVision versions 08.1.03 prior to 08.1.04 and 08.2.00 contains an untrusted search path vulnerability that allows local attackers to execute arbitrary binaries by placing a. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | HIGH | 8.7 | 0.0% | 44 |
No patch
|
| CVE-2023-7342 | HiSecOS web server contains a privilege escalation vulnerability that allows authenticated users with operator or auditor roles to escalate privileges to the administrator role by sending specially. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available. | HIGH | 8.7 | 0.0% | 44 |
No patch
|
| CVE-2024-14033 | Hirschmann Industrial IT products contain a heap overflow vulnerability in the HiLCOS web interface that allows unauthenticated remote attackers to trigger a denial-of-service condition by sending. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available. | HIGH | 8.7 | 0.0% | 44 |
No patch
|
| CVE-2026-89025 | Remote unauthenticated attackers can force Hirschmann HiOS industrial switches to reboot by sending a specially crafted HTTP(S) request to a specific endpoint of the device's integrated web server, causing a temporary denial of service. Affected units are those running HiOS versions prior to the fixes released in 07.1.12, 08.7.10, 09.0.13, 09.3.03, 10.3.08 and 10.5.00. No public exploit code or in-the-wild exploitation has been identified at time of analysis, but the flaw is trivially reachable over the network (CVSS 4.0 base 8.7, AV:N/PR:N/UI:N) against any switch whose management interface is exposed. | HIGH | 8.7 | – | 44 |
|
| CVE-2016-15058 | Hirschmann HiLCOS Classic Platform switches Classic L2E, L2P, L3E, L3P versions prior to 09.0.06 and Classic L2B prior to 05.3.07 contain a credential exposure vulnerability where user passwords are. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available. | HIGH | 8.6 | 0.0% | 43 |
No patch
|
| CVE-2023-7343 | HiSecOS web server contains a privilege escalation vulnerability that allows authenticated users with operator or auditor roles to escalate privileges to the administrator role by sending specially. Rated high severity (CVSS 8.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available. | HIGH | 8.5 | 0.0% | 43 |
No patch
|
| CVE-2017-20238 | Hirschmann Industrial HiVision versions 06.0.00 and 07.0.00 prior to 06.0.06 and 07.0.01 contains an improper authorization vulnerability that allows read-only users to gain write access to managed. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available. | HIGH | 7.1 | 0.0% | 36 |
No patch
|
| CVE-2022-4987 | Hirschmann Industrial HiVision version 08.1.03 prior to 08.1.04 and 08.2.00 contains a vulnerability in the execution of user-configured external applications that allows a local attacker to execute. Rated high severity (CVSS 7.0), this vulnerability is low attack complexity. No vendor patch available. | HIGH | 7.0 | 0.0% | 35 |
No patch
|