CVE-2017-20238 - CVE House
Back to Database
Status published High CVE-2017-20238

Hirschmann Industrial HiVision Improper Authorization Privilege Escalation

Vulnerability Description

Hirschmann Industrial HiVision versions 06.0.00 and 07.0.00 prior to 06.0.06 and 07.0.01 contains an improper authorization vulnerability that allows read-only users to gain write access to managed devices by bypassing access control mechanisms. Attackers can exploit alternative interfaces such as the web interface or SNMP browser to modify device configurations despite having restricted permissions.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-20238

Credits & Attribution

No credits recorded in the NVD database.

References

More from Belden

View All →
CVE-2025-15620
HiOS Switch Platform Denial-of-Service via Web Interface
Critical 9.2
CVE-2024-14034
Hirschmann HiEOS Authentication Bypass via HTTP Management Module
Critical 9.3
CVE-2024-14033
Hirschmann EagleSDV Denial of Service via TLS
High 8.7
CVE-2023-7343
Belden Industrial HiVision Arbitrary Code Execution via Malicious Project File
High 8.5
CVE-2023-7342
Belden HiSecOS Web Server Privilege Escalation
High 8.7

Affected Vendor

Affected Software

Hirschmann Industrial HiVision
Vulnerable Versions:
06.0.06, 07.0.01, 06.0.00, 0

Timeline

Official Publish: April 3rd, 2026
Last Modified: May 25th, 2026
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Weaknesses (CWE)

CWE-285

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1548 Abuse Elevation Control Mechanism
Privilege Escalation
T1021 Remote Services
Lateral Movement
T1098 Account Manipulation
Defense Evasion