CVE-2017-20238— Hirschmann Industrial HiVision Improper Authorization Privilege Escalation
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2017-20238
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Hirschmann Industrial HiVision Improper Authorization Privilege Escalation
Source: NVD (National Vulnerability Database)
Vulnerability Description
Hirschmann Industrial HiVision versions 06.0.00 and 07.0.00 prior to 06.0.06 and 07.0.01 contains an improper authorization vulnerability that allows read-only users to gain write access to managed devices by bypassing access control mechanisms. Attackers can exploit alternative interfaces such as the web interface or SNMP browser to modify device configurations despite having restricted permissions.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
Belden Hirschmann Industrial HiVision 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Belden Hirschmann Industrial HiVision是美国Belden公司的一款工业网络管理软件平台。 Belden Hirschmann Industrial HiVision 06.0.06之前版本和07.0.01之前版本存在授权问题漏洞，该漏洞源于授权不当，可能导致只读用户通过绕过访问控制机制获得对托管设备的写入权限。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Belden | Hirschmann Industrial HiVision | 06.0.06 | - |
II. Public POCs for CVE-2017-20238
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2017-20238
请登录查看更多情报信息。
Same Patch Batch · Belden · 2026-04-03 · 11 CVEs total
| CVE-2017-20237 | 9.8 CRITICAL | Hirschmann Industrial HiVision Authentication Bypass Remote Code Execution |
| CVE-2018-25237 | 9.8 CRITICAL | Hirschmann HiSecOS Buffer Overflow via HTTPS Login |
| CVE-2018-25236 | 9.8 CRITICAL | Hirschmann HiOS HiSecOS Authentication Bypass via HTTP Management |
| CVE-2017-20234 | 9.8 CRITICAL | GarrettCom Magnum 6K and 10K Authentication Bypass via Hardcoded String |
| CVE-2021-4477 | 9.1 CRITICAL | Hirschmann HiLCOS OpenBAT BAT450 IPv6 IPsec Firewall Bypass |
| CVE-2016-15058 | 8.1 HIGH | Hirschmann HiLCOS Classic Platform Password Exposure via SNMP |
| CVE-2020-37216 | 7.5 HIGH | Hirschmann HiOS EtherNet/IP Stack Denial of Service |
| CVE-2015-10148 | 7.5 HIGH | Hirschmann HiLCOS Hard-coded Credentials SSH SSL Keys |
| CVE-2022-4987 | 7.3 HIGH | Hirschmann Industrial HiVision External Application Path Hijacking Leading to Arbitrary Co |
| CVE-2017-20233 | 5.4 MEDIUM | Hirschmann HiLCOS Layer-2 Firewall Multicast Broadcast Traffic Bypass |
IV. Related Vulnerabilities
Same vendor: Belden
- CVE-2017-20234
GarrettCom Magnum 6K and 10K Authentication Bypass via Hardc - CVE-2017-20233
Hirschmann HiLCOS Layer-2 Firewall Multicast Broadcast Traff - CVE-2018-25236
Hirschmann HiOS HiSecOS Authentication Bypass via HTTP Manag - CVE-2021-4477
Hirschmann HiLCOS OpenBAT BAT450 IPv6 IPsec Firewall Bypass - CVE-2016-15058
Hirschmann HiLCOS Classic Platform Password Exposure via SNM
Same weakness: CWE-285
- CVE-2026-8241
Industrial Application Software IAS Canias ERP RMI iasGetSer - CVE-2026-42202
nova-toggle-5: Improper authorization on toggle endpoint all - CVE-2026-33823
Microsoft Team Events Portal Information Disclosure Vulnerab - CVE-2026-41572
Note Mark: Unauthenticated read of notes and assets in soft- - CVE-2026-7713
crocodilestick Calibre-Web-Automated Kobo auth-token Route k
V. Comments for CVE-2017-20238
No comments yet