Vulnerability in Hirschmann HiLCOS Devices Linked to Default SSH and SSL Keys

CVE-2015-10148

What is CVE-2015-10148?

Hirschmann HiLCOS devices, including OpenBAT, WLC, BAT300, and BAT54, prior to version 8.80 and OpenBAT prior to 9.10, are shipped with identical default SSH and SSL keys. This security misconfiguration allows unauthenticated remote attackers to exploit these default keys, facilitating man-in-the-middle attacks that enable device impersonation and the interception of sensitive management communications. The inability to change these default keys leaves devices vulnerable to unauthorized access, threatening the confidentiality and integrity of data transmitted over these connections.

References