CVE-2017-20237 Hirschmann Industrial HiVision Authentication Bypass Remote Code Execution

CriticalCVSS 9.3 EPSS 0.98%

Published: 2026-04-04 00:05
Updated: 2026-07-21 10:10
Exploit status: No public exploit known

Description

Hirschmann Industrial HiVision versions prior to 06.0.07 and 07.0.03 contains an authentication bypass vulnerability in the master service that allows unauthenticated remote attackers to execute arbitrary commands with administrative privileges. Attackers can invoke exposed interface methods over the remote service to bypass authentication and achieve remote code execution on the underlying operating system.

Affected products

Product	Affected versions	Fixed in
Belden Hirschmann Industrial HiVision	<= 06.0.06	No fix listed
Belden Hirschmann Industrial HiVision	<= 07.0.02	No fix listed

References

assets.belden.com vendor-advisory
www.vulncheck.com third-party-advisory

CVSS v4.0

9.3 Critical

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: None
Vulnerable System Confidentiality: High
Vulnerable System Integrity: High
Vulnerable System Availability: High
Subsequent System Confidentiality: None
Subsequent System Integrity: None
Subsequent System Availability: None

All scores (4)

v4.0 9.3 · vulncheck
v4.0 9.3 · disclosure@vulncheck.com
v3.1 9.8 · vulncheck
v3.1 9.8 · disclosure@vulncheck.com

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.98% (percentile 62.7)
CWE: CWE-287 Improper Authentication (CWE-287)

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.