CVE-2015-10148 - CVE House
Back to Database
Status published High CVE-2015-10148

Hirschmann HiLCOS Hard-coded Credentials SSH SSL Keys

Vulnerability Description

Hirschmann HiLCOS devices OpenBAT, WLC, BAT300, BAT54 prior to 8.80 and OpenBAT prior to 9.10 are shipped with identical default SSH and SSL keys that cannot be changed, allowing unauthenticated remote attackers to decrypt or intercept encrypted management communications. Attackers can perform man-in-the-middle attacks, impersonate devices, and expose sensitive information by leveraging the shared default cryptographic keys across multiple devices.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2015-10148

Credits & Attribution

No credits recorded in the NVD database.

References

More from Belden

View All →
CVE-2025-15620
HiOS Switch Platform Denial-of-Service via Web Interface
Critical 9.2
CVE-2024-14034
Hirschmann HiEOS Authentication Bypass via HTTP Management Module
Critical 9.3
CVE-2024-14033
Hirschmann EagleSDV Denial of Service via TLS
High 8.7
CVE-2023-7343
Belden Industrial HiVision Arbitrary Code Execution via Malicious Project File
High 8.5
CVE-2023-7342
Belden HiSecOS Web Server Privilege Escalation
High 8.7

Affected Vendor

Affected Software

Hirschmann HiLCOS
Vulnerable Versions:
9.00, 0, 9.10

Timeline

Official Publish: April 3rd, 2026
Last Modified: May 25th, 2026
Added to House: July 19th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weaknesses (CWE)

CWE-321

MITRE ATT&CK TTPs

T1552 Unsecured Credentials
Credential Access
T1040 Network Sniffing
Credential Access
T1537 Transfer Data to Cloud Account
Credential Access
T1078 Valid Accounts
Persistence
T1041 Exfiltration Over C2 Channel
Exfiltration