CVE-2017-20238

Hirschmann Industrial HiVision Improper Authorization Privilege Escalation

State: Published
Severity: 7.1 High
Published: Apr 3, 2026
Updated: Oct 29, 2026
Reserved: Apr 3, 2026

Description

Hirschmann Industrial HiVision versions 06.0.00 and 07.0.00 prior to 06.0.06 and 07.0.01 contains an improper authorization vulnerability that allows read-only users to gain write access to managed devices by bypassing access control mechanisms. Attackers can exploit alternative interfaces such as the web interface or SNMP browser to modify device configurations despite having restricted permissions.

Scores

CVSS	Score	Vector	Source
4.0	7.1 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	7.1 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N	VulnCheck

Weaknesses

CWE-285 Improper Authorization

Affected Products

Product	Versions
Hirschmann Industrial HiVisionBelden	06.0.06Not affected 07.0.01Not affected 06.0.00 through 06.0.05Affected 07.0.00 to before 07.0.01Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.