CVE-2018-25236Disclosure

LOWCVSS 9.3 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Hirschmann HiOS and HiSecOS products RSP, RSPE, RSPS, RSPL, MSP, EES, EESX, GRS, OS, RED, EAGLE contain an authentication bypass vulnerability in the HTTP(S) management module that allows unauthenticated remote attackers to gain administrative access by crafting specially formed HTTP requests. Attackers can exploit improper authentication handling to obtain the authentication status and privileges of a previously authenticated user without providing valid credentials.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-287

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

Technical details provided in 1 signal
Disclosure: 1 classified signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Disclosure

1100.0%

Referenced assets1 URL

By indicator

https://cvefind.com/CVE-2018-25236

Full discourse1 post

CVEFind.com@CveFindCom187d
Disclosure
[CVE-2018-25236: CRITICAL] Vulnerability in Hirschmann HiOS and HiSecOS products allows unauthenticated remote attackers to gain admin access via authentication bypass in HTTP(S) management module.#cve,CVE-2018-25236,#cybersecurity https://cvefind.com/CVE-2018-25236
Post summary
The post announces a critical authentication‑bypass vulnerability in Hirschmann HiOS and HiSecOS, describing how remote attackers can gain admin access via the HTTP(S) management interface. No PoC, exploit code, patch, or evidence of active exploitation is provided.
0102059
619 followersView on X

Explore more

Back to dashboard