CVE-2025-15620 - CVE House
Back to Database
Status published Critical CVE-2025-15620

HiOS Switch Platform Denial-of-Service via Web Interface

Vulnerability Description

HiOS Switch Platform versions 09.1.00 through 09.4.04 and 10.0.00 through 10.3.00 contain a denial-of-service vulnerability in the web interface that allows remote attackers to reboot the affected device by sending a malicious HTTP GET request to a specific endpoint. Attackers can trigger an uncontrolled reboot condition through crafted HTTP requests to cause service disruption and unavailability of the switch.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-15620

Credits & Attribution

No credits recorded in the NVD database.

References

More from Belden

View All →
CVE-2024-14034
Hirschmann HiEOS Authentication Bypass via HTTP Management Module
Critical 9.3
CVE-2024-14033
Hirschmann EagleSDV Denial of Service via TLS
High 8.7
CVE-2023-7343
Belden Industrial HiVision Arbitrary Code Execution via Malicious Project File
High 8.5
CVE-2023-7342
Belden HiSecOS Web Server Privilege Escalation
High 8.7
CVE-2023-53908
HiSecOS 04.0.01 Privilege Escalation via User Role Modification
High 8.7

Affected Vendor

Affected Software

Hirschmann HiOS Switch Platform
Vulnerable Versions:
09.1.00, 10.0.00

Timeline

Official Publish: April 2nd, 2026
Last Modified: July 14th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Weaknesses (CWE)

CWE-306

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1136 Create Account
Persistence
T1098 Account Manipulation
Privilege Escalation
T1021 Remote Services
Lateral Movement