CVE-2017-20237
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk58th percentile - higher than 58% of all known CVEs
Summary
An authentication bypass vulnerability in Hirschmann Industrial HiVision prior to versions 06.0.07 and 07.0.03 allows unauthenticated remote attackers to execute arbitrary commands with administrative privileges via the master service.
Risk Assessment
The risk includes full compromise of the underlying operating system, potentially leading to disruption of industrial network operations, data theft, or further attacks on the infrastructure.
Recommendation
Immediately update Hirschmann Industrial HiVision to version 06.0.07 or later (for the 06.x branch) or 07.0.03 or later (for the 07.x branch).
Original NVD description (English source)
Hirschmann Industrial HiVision versions prior to 06.0.07 and 07.0.03 contains an authentication bypass vulnerability in the master service that allows unauthenticated remote attackers to execute arbitrary commands with administrative privileges. Attackers can invoke exposed interface methods over the remote service to bypass authentication and achieve remote code execution on the underlying operating system.