CVE-2017-20237: Hirschmann Industrial HiVision Authentication Bypass Leading to Remote Code Execution
CVE-2017-20237 affects Belden Hirschmann Industrial HiVision versions prior to 06.0.07 and 07.0.03, where an authentication bypass in the master service can let unauthenticated remote attackers run commands with administrative privileges. The record gives a CVSS 3.1 base score of 9.8 (critical) and classifies the flaw as CWE-287. No fixed version is listed in the record, and CISA KEV does not list this CVE.
Overview
The record describes an authentication bypass in the master service of the Hirschmann Industrial HiVision product, listed as Belden Hirschmann Industrial HiVision. According to the description, exposed interface methods of the remote service can be invoked to bypass authentication and reach command execution on the underlying operating system. The weakness is classified as CWE-287 (Improper Authentication).
Impact
- Confidentiality, integrity and availability: the CVSS 3.1 vector in the record rates all three as High.
- Privilege level: the description states that commands run with administrative privileges.
- Reachability: the CVSS vector rates the attack vector as Network, with low complexity and no privileges or user interaction required.
Affected products and versions
- Belden Hirschmann Industrial HiVision prior to 06.0.07 and prior to 07.0.03, as stated in the description.
- The affected field lists versions up to 06.0.06 and up to 07.0.02, which matches the same boundary.
- The record's fixes field is empty. This does not mean no fix exists; the vendor bulletin linked in the references should be checked.
Exploitation status
- CISA KEV: the record shows this CVE is not listed (kev.listed is false).
- No confirmed exploitation appears in the sources consulted.
- The SSVC exploitation value is none, automatable is yes and technical impact is total.
- The recorded EPSS probability is 0.00961, with a percentile of 0.60599.
Remediation and mitigation
- Check the Belden security bulletin for the vendor's fixed versions and update instructions.
- Inventory every HiVision installation and identify those in the affected range.
- Until a fix is applied, limit network access to the management service to trusted administrators and isolate the host from untrusted networks.
- Inference: versions at or above 06.0.07 and 07.0.03 appear to fall outside the stated range, but confirm this against the vendor bulletin.
Detection guidance
- Review logs of the master service and management interface for access or administrative actions from unknown sources.
- Monitor the host for unexpected child processes started by the HiVision service.
- Alert on unusual connections to the service from network segments that should not reach it.
Limitations of the available information
- The record contains no fixed version field and no patch identifier.
- The record does not name the exposed interface methods involved, and this analysis does not describe them.
- The CVE identifier carries the year 2017, while the record was published on 2026-04-03. The record does not explain this difference.
- The record status is Awaiting Analysis, so scores and classifications may change.
- The EPSS date recorded is 2026-10-13. It is reported as recorded and not interpreted.
Frequently asked questions
Does this vulnerability allow remote code execution?
According to the record description, an unauthenticated remote attacker can invoke exposed interface methods to bypass authentication and reach command execution on the underlying operating system. The record gives this a CVSS 3.1 score of 9.8.
Is there a confirmed fixed version?
The record does not list a fixed version. Its description implies versions prior to 06.0.07 and 07.0.03 are affected, so the vendor bulletin linked in the references should be consulted for the correct update.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.