CVE-2015-10148 Hirschmann HiLCOS Hard-coded Credentials SSH SSL Keys
HighCVSS 8.8
EPSS 0.30%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Hirschmann HiLCOS devices OpenBAT, WLC, BAT300, BAT54 prior to 8.80 and OpenBAT prior to 9.10 are shipped with identical default SSH and SSL keys that cannot be changed, allowing unauthenticated remote attackers to decrypt or intercept encrypted management communications. Attackers can perform man-in-the-middle attacks, impersonate devices, and expose sensitive information by leveraging the shared default cryptographic keys across multiple devices.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Belden Hirschmann HiLCOS | >= 9.00, <= 9.00-RU1 | No fix listed |
| Belden Hirschmann HiLCOS | <= 8.80 | No fix listed |
References
- assets.belden.com vendor-advisory
- www.vulncheck.com third-party-advisory