CVE-2015-10148: Hirschmann HiLCOS Hard-coded Credentials SSH SSL Keys
Hirschmann HiLCOS devices OpenBAT, WLC, BAT300, BAT54 prior to 8.80 and OpenBAT prior to 9.10 are shipped with identical default SSH and SSL keys that cannot be changed, allowing unauthenticated remote attackers to decrypt or intercept encrypted management communications. Attackers can perform man-in-the-middle attacks, impersonate devices, and expose sensitive information by leveraging the shared default cryptographic keys across multiple devices.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-10148?
CVE-2015-10148 is considered a high severity vulnerability due to the presence of hard-coded credentials allowing unauthorized access.
How do I fix CVE-2015-10148?
To mitigate CVE-2015-10148, it is recommended to update to HiLCOS firmware version 8.80 or higher for affected devices.
Which devices are affected by CVE-2015-10148?
CVE-2015-10148 affects Hirschmann HiLCOS OpenBAT, WLC, BAT300, and BAT54 devices prior to the specified versions.
Can CVE-2015-10148 allow an attacker to decrypt traffic?
Yes, CVE-2015-10148 can allow unauthenticated remote attackers to decrypt or intercept encrypted traffic due to shared keys.
Is there a way to change default SSH and SSL keys to prevent CVE-2015-10148?
No, the affected Hirschmann HiLCOS devices are shipped with identical default keys that cannot be changed.