CVE-2021-4477

Hirschmann HiLCOS OpenBAT BAT450 IPv6 IPsec Firewall Bypass

State: Published
Severity: 9.3 Critical
Published: Apr 3, 2026
Updated: Apr 6, 2026
Reserved: Apr 3, 2026

Description

Hirschmann HiLCOS OpenBAT and BAT450 products contain a firewall bypass vulnerability in IPv6 IPsec deployments that allows traffic from VPN connections to bypass configured firewall rules. Attackers can exploit this vulnerability by establishing IPv6 IPsec connections (IKEv1 or IKEv2) while simultaneously using an IPv6 Internet connection to circumvent firewall policy enforcement.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	VulnCheck

Weaknesses

CWE-284 Improper access control

Affected Products

Product	Versions
Hirschmann HiLCOS OpenBATBelden	3.80-RELAffected 8.90-RELAffected 9.00-RELAffected 9.00-RU1Affected 9.10-RELAffected 9.12-RELAffected 9.12-RU1Affected 9.12-RU2Affected 9.12-RU3Affected 9.12-RU4Affected 9.12-RU5Affected 9.12-RU6Affected 9.12-RU7Affected 9.12-RU8Affected 9.12-RU9Affected 9.13-RELAffected 9.13-RU1Affected 10.12-RELAffected 10.12-RU1Affected 10.12-RU2Not affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.