CVE-2025-15620
Full vulnerability record from the local CVENow database.
Description
HiOS Switch Platform versions 09.1.00 through 09.4.04 and 10.0.00 through 10.3.00 contain a denial-of-service vulnerability in the web interface that allows remote attackers to reboot the affected device by sending a malicious HTTP GET request to a specific endpoint. Attackers can trigger an uncontrolled reboot condition through crafted HTTP requests to cause service disruption and unavailability of the switch.
Severity
CRITICAL
CVSS score
9.2
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-04-02 21:16:40.137000
Last modified
2026-10-29 21:17:03.827000
View original CVE JSON
{
"id": "CVE-2025-15620",
"sourceIdentifier": "[email protected]",
"published": "2026-04-02T21:16:40.137",
"lastModified": "2026-10-29T21:17:03.827",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "HiOS Switch Platform versions 09.1.00 through 09.4.04 and 10.0.00 through 10.3.00 contain a denial-of-service vulnerability in the web interface that allows remote attackers to reboot the affected device by sending a malicious HTTP GET request to a specific endpoint. Attackers can trigger an uncontrolled reboot condition through crafted HTTP requests to cause service disruption and unavailability of the switch."
},
{
"lang": "es",
"value": "La Plataforma HiOS Switch versiones 09.1.00 anteriores a 09.4.05 y 10.3.01 contiene una vulnerabilidad de denegación de servicio en la interfaz web que permite a atacantes remotos reiniciar el dispositivo afectado enviando una solicitud HTTP GET maliciosa a un endpoint específico. Los atacantes pueden desencadenar una condición de reinicio incontrolado a través de solicitudes HTTP manipuladas para causar interrupción del servicio y falta de disponibilidad del switch."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "Belden",
"product": "Hirschmann HiOS Switch Platform",
"defaultStatus": "unaffected",
"versions": [
{
"version": "09.1.00",
"lessThan": "09.4.05",
"versionType": "custom",
"status": "affected"
},
{
"version": "10.0.00",
"lessThan": "10.3.01",
"versionType": "custom",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 9.2,
"baseSeverity": "CRITICAL",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 4.0
},
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "NONE",
"scope": "CHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 3.9,
"impactScore": 4.0
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-03T15:38:11.509590Z",
"id": "CVE-2025-15620",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-306"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:belden:hios_switch:*:*:*:*:*:*:*:*",
"versionStartIncluding": "09.1.00",
"versionEndExcluding": "09.4.05",
"matchCriteriaId": "41B3F3C4-2A73-4488-BD79-B3D2CE62385D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:belden:hios_switch:*:*:*:*:*:*:*:*",
"versionStartIncluding": "10.0.00",
"versionEndExcluding": "10.3.01",
"matchCriteriaId": "104864CC-AAC6-4681-9140-1B7F0E8F8DCE"
}
]
}
]
}
],
"references": [
{
"url": "https://assets.belden.com/m/702a656e81736b04/original/PSIRT-2_Web_Interface_HiOS.pdf",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
},
{
"url": "https://www.vulncheck.com/advisories/hios-switch-platform-denial-of-service-via-web-interface",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
}
]
}