CVE-2018-25237: Hirschmann HiSecOS HTTPS Login Buffer Overflow
Hirschmann HiSecOS Classic Firewall versions up to 05.3.02 contain a buffer overflow in the HTTPS login interface when RADIUS authentication is enabled, according to the record's description. The flaw is classified as CWE-120, and VulnCheck scores it 9.8 under CVSS 3.1. No confirmed exploitation appears in the sources consulted, and the record lists no fixed version.
Overview
CVE-2018-25237 is a buffer overflow in the HTTPS login interface of Belden Hirschmann HiSecOS, according to the record's description. The record attributes it to improper bounds checking during password handling when RADIUS authentication is enabled. It is categorized as CWE-120 (Classic Buffer Overflow).
Impact
The description states that a remote attacker could crash the device or execute arbitrary code, resulting in denial of service or remote code execution. VulnCheck's CVSS 3.1 base score is 9.8 (Critical), and its CVSS 4.0 score is 9.3. The SSVC entries list technical impact as total and automatable as yes.
Affected products and versions
- Belden Hirschmann HiSecOS Classic Firewall (EAGLE, EAGLE One), versions up to and including 05.3.02.
- The description refers to versions prior to 05.3.03, which is consistent with the affected range.
The record does not list any fixed version.
Exploitation status
The CVE is not listed in the CISA KEV catalog in this record. No confirmed exploitation appears in the sources consulted. The SSVC exploitation field is recorded as none, and the EPSS probability is 0.00817 with a percentile of 0.56.
Remediation and mitigation
- Identify devices running HiSecOS 05.3.02 or earlier and review the vendor bulletin linked below.
- Plan an upgrade to a release the vendor identifies as fixed. The record does not name that release, so confirm the exact version in the Belden bulletin.
- Until patching is complete, restrict access to the HTTPS management interface to trusted administrative networks.
- Review whether RADIUS-based login is in use on exposed devices and reduce exposure accordingly.
Detection guidance
- Review web management and authentication logs for unusually long password submissions to the login page.
- Monitor for unexpected device reboots or loss of management availability, which may indicate crash attempts.
- Alert on login attempts to the management interface from unfamiliar sources.
Limitations of the available information
The sources do not describe the fixed release, the exact vulnerable code path, or conditions beyond those in the description. The record's source status is Awaiting Analysis. The fix version 05.3.03 is implied by the description rather than stated as a fix in the record. Reachability depends on the RADIUS configuration and network exposure.
Frequently asked questions
Which versions of Hirschmann HiSecOS are affected by CVE-2018-25237?
The record lists Belden Hirschmann HiSecOS Classic Firewall (EAGLE, EAGLE One) versions up to and including 05.3.02. The description refers to versions prior to 05.3.03.
Is this vulnerability known to be exploited in the wild?
No. The CVE is not listed in CISA KEV in this record, and no confirmed exploitation appears in the sources consulted.
Is a fixed version available?
The record does not list a fixed version. Check the Belden security bulletin for the specific release that addresses the issue.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.