CVE-2018-25237
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk53th percentile - higher than 53% of all known CVEs
Summary
Hirschmann HiSecOS devices prior to version 05.3.03 contain a buffer overflow vulnerability in the HTTPS login interface when RADIUS authentication is enabled. Remote attackers can submit a password longer than 128 characters to crash the device or execute arbitrary code.
Risk Assessment
The risk includes remote code execution (RCE) or denial of service (DoS) on Hirschmann network devices, potentially disrupting critical industrial infrastructure.
Recommendation
Immediately upgrade HiSecOS firmware to version 05.3.03 or later and restrict HTTPS interface access to trusted networks only.
Original NVD description (English source)
Hirschmann HiSecOS devices versions prior to 05.3.03 contain a buffer overflow vulnerability in the HTTPS login interface when RADIUS authentication is enabled that allows remote attackers to crash the device or execute arbitrary code by submitting a password longer than 128 characters. Attackers can exploit improper bounds checking in password handling to overflow a fixed-size buffer and achieve denial of service or remote code execution.