CVE-2024-14034CWE-287

Hirschmann HiEOS Authentication Bypass via HTTP Management Module

Critical · published April 2, 2026

CVSS v4.0
9.3
EPSS
0%
Percentile
38.6
In the wild
Unconfirmed
What it is

Hirschmann HiEOS devices versions prior to 01.1.00 contain an authentication bypass vulnerability in the HTTP(S) management module that allows unauthenticated remote attackers to gain administrative access by sending specially crafted HTTP(S) requests. Attackers can exploit improper authentication handling to obtain elevated privileges and perform unauthorized actions including configuration download or upload and firmware modification.

The record
Technical detail
CVSS v4.0
9.3 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00456 · 38.6th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-04-02T20:01Z
EPSS history
Timeline
  • 02 APR 20:01Z
    Hirschmann HiEOS Authentication Bypass via HTTP Management Module
    cvelistv5