CVE-2021-4477
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Hirschmann HiLCOS OpenBAT and BAT450 products contain a firewall bypass vulnerability in IPv6 IPsec deployments. Traffic from VPN connections can bypass configured firewall rules. Attackers can exploit this by establishing IPv6 IPsec connections (IKEv1 or IKEv2) while using an IPv6 Internet connection to circumvent firewall policy enforcement.
Risk Assessment
The organization is at risk of unauthorized access to the internal network by bypassing the firewall, potentially leading to data confidentiality and integrity breaches.
Recommendation
Update the firmware of Hirschmann HiLCOS devices to a version containing the fix for this vulnerability, and review IPsec configurations.
Original NVD description (English source)
Hirschmann HiLCOS OpenBAT and BAT450 products contain a firewall bypass vulnerability in IPv6 IPsec deployments that allows traffic from VPN connections to bypass configured firewall rules. Attackers can exploit this vulnerability by establishing IPv6 IPsec connections (IKEv1 or IKEv2) while simultaneously using an IPv6 Internet connection to circumvent firewall policy enforcement.