CVE-2024-14034 - CVE House
Back to Database
Status published Critical CVE-2024-14034

Hirschmann HiEOS Authentication Bypass via HTTP Management Module

Vulnerability Description

Hirschmann HiEOS devices versions prior to 01.1.00 contain an authentication bypass vulnerability in the HTTP(S) management module that allows unauthenticated remote attackers to gain administrative access by sending specially crafted HTTP(S) requests. Attackers can exploit improper authentication handling to obtain elevated privileges and perform unauthorized actions including configuration download or upload and firmware modification.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-14034

Credits & Attribution

No credits recorded in the NVD database.

References

More from Belden

View All →
CVE-2025-15620
HiOS Switch Platform Denial-of-Service via Web Interface
Critical 9.2
CVE-2024-14033
Hirschmann EagleSDV Denial of Service via TLS
High 8.7
CVE-2023-7343
Belden Industrial HiVision Arbitrary Code Execution via Malicious Project File
High 8.5
CVE-2023-7342
Belden HiSecOS Web Server Privilege Escalation
High 8.7
CVE-2023-53908
HiSecOS 04.0.01 Privilege Escalation via User Role Modification
High 8.7

Affected Vendor

Affected Software

Hirschmann HiEOS LRS11
Vulnerable Versions:
0

Timeline

Official Publish: April 2nd, 2026
Last Modified: May 14th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-287

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1556 Modify Authentication Process
Credential Access