Hirschmann Industrial HiVision vulnerabilities

An authentication bypass vulnerability in Hirschmann Industrial HiVision prior to versions 06.0.07 and 07.0.03 allows unauthenticated remote attackers to execute arbitrary commands with administrative privileges via the master service.

A vulnerability in Hirschmann Industrial HiVision versions 06.0.00 and 07.0.00 prior to 06.0.06 and 07.0.01 allows read-only users to gain write access to managed devices by bypassing access control mechanisms. Attackers can exploit alternative interfaces such as the web interface or SNMP browser to modify device configurations.

Hirschmann Industrial HiVision versions 08.1.03 prior to 08.1.04 and 08.2.00 contain a vulnerability in the execution of user-configured external applications. A local attacker can place a malicious binary in the execution path, leading to arbitrary code execution with elevated privileges.

An arbitrary code execution vulnerability in Hirschmann Industrial HiVision versions 05.0.00 through 08.3.01 prior to 08.3.02. An attacker can exploit it when an administrator opens a maliciously crafted project file. Code execution occurs in the context of the HiVision process.