CVE-2026-89025

HighCVSS 7.5

Published: 15/09/2026(UTC)Updated: 24/09/2026(UTC)Translated: 15/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.77%

54th percentile - higher than 54% of all known CVEs

Summary

Denial-of-service vulnerability in the integrated web server of Hirschmann HiOS Switch Platform devices. A remote unauthenticated attacker can send a specially crafted HTTP(S) request to a specific endpoint that is processed incorrectly, causing an unintended reboot and temporary denial of service. The issue is fixed in versions 07.1.12, 08.7.10, 09.0.13, 09.3.03, 10.3.08, and 10.5.00.

Risk Assessment

An attack may cause network outages and affect service availability. The lack of authentication increases the risk of remote exploitation.

Recommendation

Update the device firmware to one of the listed patched versions as soon as possible and monitor network traffic for suspicious HTTP(S) requests.

Other vulnerabilities in Hirschmann HiOS

CVE-2020-37216High
Hirschmann HiOS devices before versions 08.1.00 and 07.1.01 contain a denial of service vulnerability in the EtherNet/IP stack where improper handling of packet length fields allows remote attackers to crash or hang the device by sending specially crafted UDP EtherNet/IP packets with a length value larger than the actual packet size.

Original NVD description (English source)

Hirschmann HiOS Switch Platform devices contain a denial-of-service vulnerability in the integrated web server due to missing validation of HTTP(S) content. A remote unauthenticated attacker can send a specially crafted HTTP(S) request to a specific endpoint that is processed incorrectly, causing the device to perform an unintended reboot and resulting in a temporary denial-of-service condition. This vulnerability has been addressed in versions 07.1.12, 08.7.10, 09.0.13, 09.3.03, 10.3.08, and 10.5.00.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS