CVE-2018-5465 Auth bypass in Hirschmann Automation and Control GmbH Classic Platform Switches

High 8.8 Published 6 Mar 2018 Updated 5 Aug 2024

Attackers can hijack web sessions on Hirschmann industrial switches via session fixation, potentially gaining unauthorized access to the management interface.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2018-5465?

CVE-2018-5465 is a high-severity authentication bypass vulnerability in Hirschmann Automation and Control GmbH Classic Platform Switches, published on 6 Mar 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A Session Fixation issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches. A session fixation vulnerability in the web interface has been identified, which may allow an attacker to hijack web sessions.

Weakness: CWE-384

Which versions are affected by CVE-2018-5465?

It affects 134 products.

Products include Belden Hirschmann M1-8mm-Sc, Belden Hirschmann M1-8sfp, Belden Hirschmann M1-8sm-Sc, Belden Hirschmann M1-8tp-Rj45, Belden Hirschmann Mach102-24tp-F, Belden Hirschmann Mach102-24tp-Fr and 128 more.

How do I fix CVE-2018-5465?

No fix has been published for CVE-2018-5465 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2018-5465 being exploited?

There is no known exploitation of CVE-2018-5465 in the wild and no public exploit code.

Sources

Also known as GHSA-9xwx-w5gp-5r6x.