CVE-2015-10148— Hirschmann HiLCOS Hard-coded Credentials SSH SSL Keys
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2015-10148
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Hirschmann HiLCOS Hard-coded Credentials SSH SSL Keys
Source: NVD (National Vulnerability Database)
Vulnerability Description
Hirschmann HiLCOS devices OpenBAT, WLC, BAT300, BAT54 prior to 8.80 and OpenBAT prior to 9.10 are shipped with identical default SSH and SSL keys that cannot be changed, allowing unauthenticated remote attackers to decrypt or intercept encrypted management communications. Attackers can perform man-in-the-middle attacks, impersonate devices, and expose sensitive information by leveraging the shared default cryptographic keys across multiple devices.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
使用硬编码的密码学密钥
Source: NVD (National Vulnerability Database)
Vulnerability Title
Belden多款产品 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Belden Hirschmann HiLCOS OpenBAT等都是美国Belden公司的产品。Belden Hirschmann HiLCOS OpenBAT是一款工业级无线局域网设备。Belden Hirschmann HiLCOS BAT450是一款工业级无线局域网接入点设备。Belden Hirschmann HiLCOS BAT867是一款工业级无线局域网接入点设备。 Belden多款产品存在安全漏洞，该漏洞源于使用相同且无法更改的默认SSH和SSL密钥，可能导致未经身份验证的远程攻击者解密或
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Belden | Hirschmann HiLCOS | >= 9.10 | - |
II. Public POCs for CVE-2015-10148
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2015-10148
请登录查看更多情报信息。
- Hirschmann HiLCOS Hard-coded Credentials SSH SSL Keys | Advisories | VulnCheckthird-party-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2015-10148
Same Patch Batch · Belden · 2026-04-03 · 11 CVEs total
| CVE-2017-20237 | 9.8 CRITICAL | Hirschmann Industrial HiVision Authentication Bypass Remote Code Execution |
| CVE-2018-25237 | 9.8 CRITICAL | Hirschmann HiSecOS Buffer Overflow via HTTPS Login |
| CVE-2018-25236 | 9.8 CRITICAL | Hirschmann HiOS HiSecOS Authentication Bypass via HTTP Management |
| CVE-2017-20234 | 9.8 CRITICAL | GarrettCom Magnum 6K and 10K Authentication Bypass via Hardcoded String |
| CVE-2021-4477 | 9.1 CRITICAL | Hirschmann HiLCOS OpenBAT BAT450 IPv6 IPsec Firewall Bypass |
| CVE-2016-15058 | 8.1 HIGH | Hirschmann HiLCOS Classic Platform Password Exposure via SNMP |
| CVE-2020-37216 | 7.5 HIGH | Hirschmann HiOS EtherNet/IP Stack Denial of Service |
| CVE-2022-4987 | 7.3 HIGH | Hirschmann Industrial HiVision External Application Path Hijacking Leading to Arbitrary Co |
| CVE-2017-20238 | 7.1 HIGH | Hirschmann Industrial HiVision Improper Authorization Privilege Escalation |
| CVE-2017-20233 | 5.4 MEDIUM | Hirschmann HiLCOS Layer-2 Firewall Multicast Broadcast Traffic Bypass |
IV. Related Vulnerabilities
Same vendor: Belden
- CVE-2017-20234
GarrettCom Magnum 6K and 10K Authentication Bypass via Hardc - CVE-2017-20233
Hirschmann HiLCOS Layer-2 Firewall Multicast Broadcast Traff - CVE-2018-25236
Hirschmann HiOS HiSecOS Authentication Bypass via HTTP Manag - CVE-2021-4477
Hirschmann HiLCOS OpenBAT BAT450 IPv6 IPsec Firewall Bypass - CVE-2017-20238
Hirschmann Industrial HiVision Improper Authorization Privil
Same weakness: CWE-321
- CVE-2026-8243
Industrial Application Software IAS Canias ERP JNLP Deployme - CVE-2026-6787
Usage of a hard-coded cryptographic key in WatchGuard Agent - CVE-2026-42518
Information Disclosure Vulnerability in e-Sushrut HMIS - CVE-2026-7306
Xuxueli xxl-job OpenAPI Endpoint OpenApiController.java hard - CVE-2026-32644
Milesight Cameras Use of Hard-coded Cryptographic Key
V. Comments for CVE-2015-10148
No comments yet