CVE-2024-14034
Hirschmann HiEOS Authentication Bypass via HTTP Management Module
- State
- Published
- Severity
- 9.3 Critical
- Published
- Apr 2, 2026
- Updated
- May 14, 2026
- Reserved
- Apr 1, 2026
Description
Hirschmann HiEOS devices versions prior to 01.1.00 contain an authentication bypass vulnerability in the HTTP(S) management module that allows unauthenticated remote attackers to gain administrative access by sending specially crafted HTTP(S) requests. Attackers can exploit improper authentication handling to obtain elevated privileges and perform unauthorized actions including configuration download or upload and firmware modification.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-287 Improper Authentication (CWE-287)
Affected Products
| Product | Versions |
|---|---|
Hirschmann HiEOS LRS11Belden |
|
References
- Belden Security Bulletinsvendor-advisory
- https://www.vulncheck.com/advisories/hirschmann-hieos-authentication-bypass-via-http-management-modulethird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.