CVE-2018-25236 - CVE House
Back to Database
Status published Critical CVE-2018-25236

Hirschmann HiOS HiSecOS Authentication Bypass via HTTP Management

Vulnerability Description

Hirschmann HiOS and HiSecOS products RSP, RSPE, RSPS, RSPL, MSP, EES, EESX, GRS, OS, RED, EAGLE contain an authentication bypass vulnerability in the HTTP(S) management module that allows unauthenticated remote attackers to gain administrative access by crafting specially formed HTTP requests. Attackers can exploit improper authentication handling to obtain the authentication status and privileges of a previously authenticated user without providing valid credentials.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-25236

Credits & Attribution

No credits recorded in the NVD database.

References

More from Belden

View All →
CVE-2025-15620
HiOS Switch Platform Denial-of-Service via Web Interface
Critical 9.2
CVE-2024-14034
Hirschmann HiEOS Authentication Bypass via HTTP Management Module
Critical 9.3
CVE-2024-14033
Hirschmann EagleSDV Denial of Service via TLS
High 8.7
CVE-2023-7343
Belden Industrial HiVision Arbitrary Code Execution via Malicious Project File
High 8.5
CVE-2023-7342
Belden HiSecOS Web Server Privilege Escalation
High 8.7

Affected Vendor

Affected Software

Hirschmann HiOS, Hirschmann HiSecOS EAGLE
Vulnerable Versions:
0, 06.1.05, 07.0.00, 03.1.00, 03.0.03

Timeline

Official Publish: April 3rd, 2026
Last Modified: July 15th, 2026
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-287

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1556 Modify Authentication Process
Credential Access