CVE-2026-89025

Hirschmann HiOS Switch Platform DoS via Malformed HTTP Request

State: Published
Severity: 8.7 High
Published: Sep 15, 2026
Updated: Oct 1, 2026
Reserved: Sep 10, 2026

Description

Hirschmann HiOS Switch Platform devices contain a denial-of-service vulnerability in the integrated web server due to missing validation of HTTP(S) content. A remote unauthenticated attacker can send a specially crafted HTTP(S) request to a specific endpoint that is processed incorrectly, causing the device to perform an unintended reboot and resulting in a temporary denial-of-service condition. This vulnerability has been addressed in versions 07.1.12, 08.7.10, 09.0.13, 09.3.03, 10.3.08, and 10.5.00.

Scores

CVSS	Score	Vector	Source
4.0	8.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	VulnCheck

Weaknesses

CWE-755 Improper Handling of Exceptional Conditions

Affected Products

Product	Versions
Hirschmann HiOS Switch PlatformBelden	07.0.0 through 07.1.11Affected 07.1.12Not affected 08.0.0 through 08.7.09Affected 08.7.10Not affected 09.0.00 through 09.0.12Affected 09.0.13Not affected 09.3.00 through 09.3.02Affected 09.3.03Not affected 10.0.0 through 10.3.07Affected 10.3.08Not affected 10.4.00Affected 10.5.00Affected

References

Belden Security Advisoryvendor-advisorypatch
https://www.vulncheck.com/advisories/hirschmann-hios-switch-platform-dos-via-malformed-http-requestthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.