CVE-2018-25236: Hirschmann HiOS HiSecOS Authentication Bypass via HTTP Management
Hirschmann HiOS and HiSecOS products RSP, RSPE, RSPS, RSPL, MSP, EES, EESX, GRS, OS, RED, EAGLE contain an authentication bypass vulnerability in the HTTP(S) management module that allows unauthenticated remote attackers to gain administrative access by crafting specially formed HTTP requests. Attackers can exploit improper authentication handling to obtain the authentication status and privileges of a previously authenticated user without providing valid credentials.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-25236?
CVE-2018-25236 has been rated as a critical vulnerability due to the potential for unauthenticated remote access to administrative functions.
How do I fix CVE-2018-25236?
To fix CVE-2018-25236, apply the latest firmware updates provided by Hirschmann for the affected HiOS and HiSecOS products.
What products are affected by CVE-2018-25236?
CVE-2018-25236 affects Hirschmann HiOS and HiSecOS products, including models such as RSP, RSPE, RSPS, and others.
Can CVE-2018-25236 be exploited remotely?
Yes, CVE-2018-25236 can be exploited remotely, allowing unauthenticated attackers to bypass authentication mechanisms.
Is authentication required to exploit CVE-2018-25236?
No, CVE-2018-25236 allows for exploitation without authentication, posing a significant security risk.