CVE Intelligence
Analysis AI-assisted

CVE-2021-4477: Hirschmann HiLCOS OpenBAT and BAT450 IPv6 IPsec Firewall Bypass

CVE-2021-4477 describes a firewall bypass in Hirschmann HiLCOS OpenBAT and BAT450 products when IPv6 IPsec VPN connections are used, allowing VPN traffic to avoid configured firewall rules. The record is rated critical with a CVSS v3.1 score of 9.1 from VulnCheck, and it is not listed in CISA KEV. The record does not identify affected or fixed versions.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2021-4477 is a firewall bypass (CWE-284, Improper Access Control) affecting Hirschmann HiLCOS OpenBAT and BAT450 products. According to the record description, the issue appears in IPv6 IPsec deployments, where VPN traffic can avoid configured firewall rules.

Impact

The record describes traffic bypassing firewall policy enforcement. The CVSS v3.1 vector listed in the record indicates a network attack vector, low complexity, no privileges required and no user interaction, with high confidentiality and integrity impact and no availability impact. VulnCheck also lists a CVSS v4.0 score of 9.3.

Affected products and versions

  • Products named in the description: Hirschmann HiLCOS OpenBAT and BAT450.
  • The record contains no affected version ranges and no fixed versions.
  • Whether a specific firmware release is vulnerable must be confirmed with the vendor.

Exploitation status

  • The record shows this CVE is not listed in the CISA KEV catalog.
  • No confirmed exploitation appears in the sources consulted.
  • EPSS for the record: probability 0.00319, percentile 0.23066, dated 2026-10-13.

Remediation and mitigation

  • Review the vendor bulletin referenced in the record and current vendor firmware guidance for these products.
  • If IPv6 IPsec is not required in your deployment, disabling or restricting it reduces exposure.
  • Verify that firewall policies protecting VPN-terminated networks also cover IPv6 paths, not only IPv4.
  • Limit IPv6 Internet exposure of management and VPN endpoints where practical.

Detection guidance

  • Review logs and session records of IPsec tunnels over IPv6 for traffic reaching internal segments that policy should restrict.
  • Compare observed IPv6 VPN flows against the intended firewall policy to identify gaps.
  • Treat unexpected reachability from IPv6 Internet sources toward protected networks as a signal for investigation.

Limitations of the available information

  • The record has no affected or fixed versions and no patch details.
  • The Belden security bulletin is referenced, but its content was not reviewed for this analysis.
  • The CVE identifier year (2021) differs from the publication date (2026-04-03), and the EPSS date is later than the publication date; these values are reported as recorded.
  • The record status is Awaiting Analysis.

Frequently asked questions

Is this vulnerability being actively exploited?

The record does not list CVE-2021-4477 in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Which versions are affected?

The record does not list affected or fixed versions for HiLCOS OpenBAT or BAT450. Confirm applicability with Hirschmann or Belden.

What should defenders do now?

Review the vendor guidance, check whether IPv6 IPsec is in use, and verify that firewall policies also cover VPN traffic over IPv6.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.