Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2017-20238— Hirschmann Industrial HiVision Improper Authorization Privilege Escalation

Quick assessment

Affected

Belden Hirschmann Industrial HiVision

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Belden Hirschmann Industrial HiVision是美国Belden公司的一款工业网络管理软件平台。 Belden Hirschmann Industrial HiVision 06.0.06之前版本和07.0.01之前版本存在授权问题漏洞，该漏洞源于授权不当，可能导致只读用户通过绕过访问控制机制获得对托管设备的写入权限。

CVSS 7.1 · High EPSS 0.24% · P13 Updated May 26, 2026

Possible ATT&CK Techniques 2 AI

T1528 · Steal Application Access Token T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 4

Vendor	Product	Version Range	Status
Belden	Hirschmann Industrial HiVision	`06.0.06`	unaffected
		`07.0.01`	unaffected
		`06.0.00≤ 06.0.05`	affected
		`≤ 07.00`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2017-20238

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Hirschmann Industrial HiVision Improper Authorization Privilege Escalation

Source: CVE Program / CVE List V5

Vulnerability Description

Hirschmann Industrial HiVision versions 06.0.00 and 07.0.00 prior to 06.0.06 and 07.0.01 contains an improper authorization vulnerability that allows read-only users to gain write access to managed devices by bypassing access control mechanisms. Attackers can exploit alternative interfaces such as the web interface or SNMP browser to modify device configurations despite having restricted permissions.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制不恰当

Source: CVE Program / CVE List V5

Vulnerability Title

Belden Hirschmann Industrial HiVision 授权问题漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Belden	Hirschmann Industrial HiVision	06.0.06	-

II. Public POCs for CVE-2017-20238

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2017-20238

请登录查看更多情报信息。

https://www.cve.org/CVERecord?id=CVE-2017-20238

Same Patch Batch · Belden · 2026-04-03 · 11 CVEs total

CVE-2017-20237	9.8 CRITICAL	Hirschmann Industrial HiVision Authentication Bypass Remote Code Execution
CVE-2018-25237	9.8 CRITICAL	Hirschmann HiSecOS Buffer Overflow via HTTPS Login
CVE-2018-25236	9.8 CRITICAL	Hirschmann HiOS HiSecOS Authentication Bypass via HTTP Management
CVE-2017-20234	9.8 CRITICAL	GarrettCom Magnum 6K and 10K Authentication Bypass via Hardcoded String
CVE-2021-4477	9.1 CRITICAL	Hirschmann HiLCOS OpenBAT BAT450 IPv6 IPsec Firewall Bypass
CVE-2015-10148	8.2 HIGH	Hirschmann HiLCOS Hard-coded Credentials SSH SSL Keys
CVE-2016-15058	8.1 HIGH	Hirschmann HiLCOS Classic Platform Password Exposure via SNMP
CVE-2020-37216	7.5 HIGH	Hirschmann HiOS EtherNet/IP Stack Denial of Service
CVE-2022-4987	7.3 HIGH	Hirschmann Industrial HiVision External Application Path Hijacking Leading to Arbitrary Co
CVE-2017-20233	5.4 MEDIUM	Hirschmann HiLCOS Layer-2 Firewall Multicast Broadcast Traffic Bypass

IV. Related Vulnerabilities

Same product: Hirschmann Industrial HiVision

Same vendor: Belden

Same weakness: CWE-285

V. Comments for CVE-2017-20238

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2017-20238— Hirschmann Industrial HiVision Improper Authorization Privilege Escalation

Quick assessment

Possible ATT&CK Techniques 2 AI

Affected Version Matrix 4

I. Basic Information for CVE-2017-20238

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2017-20238

III. Intelligence Information for CVE-2017-20238

Same Patch Batch · Belden · 2026-04-03 · 11 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2017-20238

Leave a comment