CVE-2018-25237 Hirschmann HiSecOS Buffer Overflow via HTTPS Login
CriticalCVSS 9.3
EPSS 0.83%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Hirschmann HiSecOS devices versions prior to 05.3.03 contain a buffer overflow vulnerability in the HTTPS login interface when RADIUS authentication is enabled that allows remote attackers to crash the device or execute arbitrary code by submitting a password longer than 128 characters. Attackers can exploit improper bounds checking in password handling to overflow a fixed-size buffer and achieve denial of service or remote code execution.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Belden Hirschmann HiSecOS Classic Firewall (EAGLE, EAGLE One) | <= 05.3.02 | No fix listed |
References
- assets.belden.com vendor-advisory
- www.vulncheck.com third-party-advisory