CVE-2018-5469 Auth bypass in Hirschmann Automation and Control GmbH Classic Platform Switches

Critical 9.8 Published 6 Mar 2018 Updated 5 Aug 2024

Attackers can brute force credentials on the web interface of Hirschmann industrial switches due to missing rate limiting, potentially gaining unauthorized access.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-5469?

CVE-2018-5469 is a critical authentication bypass vulnerability in Hirschmann Automation and Control GmbH Classic Platform Switches, published on 6 Mar 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An Improper Restriction of Excessive Authentication Attempts issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches. An improper restriction of excessive authentication vulnerability in the web interface has been identified, which may allow an attacker to brute force authentication.

Weakness: CWE-307

Which versions are affected by CVE-2018-5469?

It affects 134 products.

Products include Belden Hirschmann M1-8mm-Sc, Belden Hirschmann M1-8sfp, Belden Hirschmann M1-8sm-Sc, Belden Hirschmann M1-8tp-Rj45, Belden Hirschmann Mach102-24tp-F, Belden Hirschmann Mach102-24tp-Fr and 128 more.

How do I fix CVE-2018-5469?

No fix has been published for CVE-2018-5469 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2018-5469 being exploited?

There is no known exploitation of CVE-2018-5469 in the wild and no public exploit code.

Sources

Also known as GHSA-m538-hxpg-3fvh.