CVE-2016-15058

Hirschmann HiLCOS Classic Platform Password Exposure via SNMP

State: Published
Severity: 8.6 High
Published: Apr 3, 2026
Updated: May 14, 2026
Reserved: Apr 3, 2026

Description

Hirschmann HiLCOS Classic Platform switches Classic L2E, L2P, L3E, L3P versions prior to 09.0.06 and Classic L2B prior to 05.3.07 contain a credential exposure vulnerability where user passwords are synchronized with SNMPv1/v2 community strings and transmitted in plaintext when the feature is enabled. Attackers with local network access can sniff SNMP traffic or extract configuration data to recover plaintext credentials and gain unauthorized administrative access to the switches.

Scores

CVSS	Score	Vector	Source
4.0	8.6 High	CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	8.1 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	VulnCheck

Weaknesses

CWE-257 Storing Passwords in a Recoverable Format

Affected Products

Product	Versions
Hirschmann HiLCOS Classic PlatformBelden	>= 09.0.06Not affected >= 05.3.07Not affected 09.0.05 and earlierAffected 05.3.06 and earlierAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.