Loading story…
Belden disclosed a high-severity privilege-escalation vulnerability, CVE-2023-7342, in the HiSecOS web server that allows authenticated users with operator or auditor roles to obtain administrator privileges by sending specially crafted packets. Successful exploitation can give an attacker full administrative control of the affected device, raising the risk of unauthorized configuration changes and broader compromise in environments that rely on the platform.
A related CVE entry, CVE-2023-7343, was published alongside the advisory stream and references a Belden security bulletin, but the available record appears to repeat the HiSecOS privilege-escalation details rather than clearly describing the separate issue named in its title. Both entries were published with CVSS v3.1 and CVSS v4.0 scoring metadata and CWE-269 classification, indicating Belden customers should review the vendor advisories closely to identify affected products and apply any recommended mitigations or updates.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A CVE entry for CVE-2023-7343 was published with a reference to a Belden security bulletin and severity metadata including CWE and CVSS vectors. The synopsis labels it as affecting Belden Industrial HiVision, though the provided description appears inconsistent and repeats HiSecOS privilege-escalation details.
A CVE entry describes a privilege escalation flaw in the Belden HiSecOS web server that allows authenticated operator or auditor users to escalate to administrator by sending specially crafted packets. Successful exploitation could grant full administrative access to the affected device.
The vulnerability history for CVE-2023-7342 and CVE-2023-7343 indicates the records were newly received by disclosure@vulncheck.com. The entries reference Belden advisories and classify the issues as high-severity vulnerabilities affecting Belden products.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Belden disclosed two high-severity vulnerabilities in **Hirschmann Industrial HiVision** that can lead to arbitrary code execution. The more serious issue, tracked as `CVE-2017-20237`, is an authentication bypass in the product's master service that affects versions prior to **06.0.07** and **07.0.03**. An unauthenticated remote attacker can invoke exposed interface methods and execute commands with administrative privileges on the underlying operating system, creating a full remote code execution path with high impact to confidentiality, integrity, and availability. A second flaw, `CVE-2022-4987`, affects **08.1.03** prior to **08.1.04** and **08.2.00** and stems from improper sanitization of paths used to launch user-configured external applications. In that scenario, a low-privileged local attacker can place a malicious binary in the execution path so it runs instead of the intended program, potentially gaining elevated execution depending on deployment context. The vulnerabilities were documented in Belden security guidance and VulnCheck advisories, highlighting both remote and local routes to code execution in Industrial HiVision deployments.
Jun 29, 2026
Hirschmann disclosed a critical vulnerability, tracked as **`CVE-2018-25236`**, in the HTTP(S) management module of multiple **HiOS** and **HiSecOS** product lines, including **RSP, RSPE, RSPS, RSPL, MSP, EES, EESX, GRS, OS, RED, and EAGLE**. The flaw allows an unauthenticated remote attacker to send specially crafted HTTP requests and gain administrative access to affected devices without valid credentials. The issue stems from improper authentication handling that can cause a new request to inherit the authentication state and privileges of a previously authenticated user. Belgium's Centre for Cybersecurity (CCB) issued a warning describing the bug as critical and urged organizations using affected Hirschmann industrial networking products to patch immediately to prevent unauthorized takeover of device management interfaces.
Jun 29, 2026
CERT-FR issued advisories for multiple vulnerabilities affecting **Belden NetModule Router Software** and a range of **Siemens** products. The flaws in Belden NetModule Router Software could allow a remote attacker to execute arbitrary code on affected systems and trigger a remote denial of service, raising concern for organizations that rely on these devices in operational and industrial environments. A separate CERT-FR notice reported multiple vulnerabilities across Siemens products that could enable **remote code execution**, **privilege escalation**, and **remote denial of service**. While the available notice summary did not list specific product names, `CVE` identifiers, or patch details, the combined disclosures indicate broad exposure across industrial technology vendors and underscore the need for defenders to identify affected assets and apply vendor guidance as updates become available.
Jun 29, 2026