CVE-2023-7343— Belden Industrial HiVision Arbitrary Code Execution via Malicious Project File
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2023-7343
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Belden Industrial HiVision Arbitrary Code Execution via Malicious Project File
Source: NVD (National Vulnerability Database)
Vulnerability Description
HiSecOS web server versions 05.0.00 to 08.3.01 prior to 08.3.02 contains a privilege escalation vulnerability that allows authenticated users with operator or auditor roles to escalate privileges to the administrator role by sending specially crafted packets to the web server. Attackers can exploit this flaw to gain full administrative access to the affected device.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
特权管理不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
Belden HiSecOS 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Belden HiSecOS是美国百通（Belden）公司的一套用于工业安全路由器的操作系统。 Belden HiSecOS web server 08.3.02之前版本存在安全漏洞，该漏洞源于向Web服务器发送特制数据包时存在权限提升漏洞，可能导致具有操作员或审计员角色的用户提升至管理员角色。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Belden | Hirschmann Industrial HiVision | 05.0.00 ~ 08.3.01 | - |
II. Public POCs for CVE-2023-7343
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-7343
请登录查看更多情报信息。
Same Patch Batch · Belden · 2026-04-02 · 6 CVEs total
| CVE-2024-14034 | 9.8 CRITICAL | Hirschmann HiEOS Authentication Bypass via HTTP Management Module |
| CVE-2025-15620 | 9.3 CRITICAL | HiOS Switch Platform Denial-of-Service via Web Interface |
| CVE-2023-7342 | 8.8 HIGH | Belden HiSecOS Web Server Privilege Escalation |
| CVE-2024-14033 | 7.5 HIGH | Hirschmann EagleSDV Denial of Service via TLS |
| CVE-2022-4986 | 7.5 HIGH | Hirschmann EagleSDV Denial of Service via TLS |
IV. Related Vulnerabilities
Same vendor: Belden
- CVE-2017-20234
GarrettCom Magnum 6K and 10K Authentication Bypass via Hardc - CVE-2017-20233
Hirschmann HiLCOS Layer-2 Firewall Multicast Broadcast Traff - CVE-2018-25236
Hirschmann HiOS HiSecOS Authentication Bypass via HTTP Manag - CVE-2021-4477
Hirschmann HiLCOS OpenBAT BAT450 IPv6 IPsec Firewall Bypass - CVE-2017-20238
Hirschmann Industrial HiVision Improper Authorization Privil
Same weakness: CWE-269
- CVE-2026-42562
Plainpad: Privilege Escalation via Writable Admin Field in P - CVE-2026-41163
bubblewrap vulnerable to privilege escalation in setuid mode - CVE-2026-44987
SysReptor: Privilege Escalation from User Admin to Superuser - CVE-2026-42185
People: Privilege Escalation via Missing Role Ceiling in Mai - CVE-2026-40001
Local privilege escalation vulnerability in ZTE PROCESS Guar
V. Comments for CVE-2023-7343
No comments yet