External risk intelligence

Hirschmann HiOS and HiSecOS HTTP(S) Management Authentication Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2018-25236

The vulnerability resides in the HTTP(S) management module of industrial network devices. While these are often placed in internal segments, web-based management interfaces for network infrastructure hardware are frequently exposed or accessible via jump hosts or management networks, making them a common target for remote access.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in Hirschmann's HiOS and HiSecOS product lines, specifically within the HTTP(S) management module. This flaw allows for an authentication bypass, potentially enabling unauthenticated remote attackers to gain administrative access. The issue arises from improper handling of authentication, which could permit attackers to assume the privileges of a previously authenticated user without valid credentials.

Administrative access bypassed without credentials.
Potential for unauthorized control of critical systems.
Confirm relevance and exposure to affected devices.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted HTTP requests to the device's management interface. This bypasses the authentication controls, granting the attacker administrative privileges. The attack can be carried out remotely without any prior authentication.

Unauthenticated remote access required.
Specially crafted HTTP requests trigger vulnerability.
Attacker gains administrative access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated remote attackers to bypass authentication in the HTTP(S) management module, potentially leading to administrative access and unauthorized control over affected Hirschmann devices. This could impact the availability and integrity of the managed network services when supported by the advisory.

Administrative access to network devices.
Crafted HTTP requests could bypass authentication.
Unauthorized control over network services.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability affects Hirschmann HiOS and HiSecOS products used in industrial environments. Ownership typically falls to the industrial control system (ICS) or operational technology (OT) infrastructure teams, in coordination with network and security teams. The first practical step is to identify all instances of the affected Hirschmann devices, confirm their network exposure, and determine their criticality to operations before planning any remediation actions, potentially involving vendor coordination.

Ownership: ICS/OT infrastructure and security teams.
Verify: Device exposure and operational criticality.
Action: Plan vendor-coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Hirschmann HiOS and HiSecOS software used for?

HiOS and HiSecOS are specialized operating systems that run on Hirschmann industrial networking hardware, such as the RSP, RSPE, and EAGLE product lines. These devices are designed to manage communications in industrial control and operational technology environments. They act as the backbone for critical network infrastructure, ensuring reliable connectivity and data flow for automated systems in sectors like manufacturing and energy.

What is the authentication bypass vulnerability in CVE-2018-25236?

This vulnerability is classified as CWE-287, which refers to improper authentication. In this context, it means the device's web-based management module fails to correctly verify the identity of someone trying to connect. Instead of requiring a valid username and password, the system can be tricked by specifically crafted web requests into believing the visitor is already a logged-in administrator, granting them full control without proper credentials.

How does an attacker trigger this authentication bypass?

An attacker triggers this by sending specially crafted HTTP or HTTPS requests to the device's management interface. Because the flaw lies in how the module processes these network requests, the attacker does not need to have a pre-existing account or perform a login action. Simply sending the malicious request to the web interface is enough to bypass the security check. The vulnerability is not triggered by standard, legitimate management traffic from authorized users.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal indicates that while these industrial devices are often kept on internal networks, their web-based management modules are frequent targets. If your Hirschmann device is accessible over the network—even through jump hosts or restricted management segments—it could be reachable by an attacker. You should evaluate how these interfaces are segmented and whether they can be reached by unauthorized internal or external network paths.

What should I do first to address this vulnerability?

Begin by creating a comprehensive inventory of all Hirschmann devices in your environment that run the affected HiOS or HiSecOS versions. Once mapped, confirm which devices have their management interfaces reachable over the network. After identifying your exposure, prioritize these devices based on their operational criticality. Finally, consult the official vendor guidance to coordinate appropriate security updates or configuration changes for your specific hardware models.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.