CVE-2024-14034

Hirschmann HiEOS Authentication Bypass via HTTP Management Module

CVSS 9.3 CRITICALEPSS 0.5%CWE-287

Vexday Risk Score

28Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 9.3EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

02 Apr 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Hirschmann HiEOS devices versions prior to 01.1.00 contain an authentication bypass vulnerability in the HTTP(S) management module that allows unauthenticated remote attackers to gain administrative access by sending specially crafted HTTP(S) requests. Attackers can exploit improper authentication handling to obtain elevated privileges and perform unauthorized actions including configuration download or upload and firmware modification.

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products

Belden · Hirschmann HiEOS LRS11

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://assets.belden.com/m/7ec5c6da25ef288/original/Belden_Security_Bulletin_BSECV-2024-02_1v0.pdf https://www.vulncheck.com/advisories/hirschmann-hieos-authentication-bypass-via-http-management-module