CVE-2015-10148 in Hirschmann HiLCOS
Summary
by MITRE • 04/04/2026
Hirschmann HiLCOS devices OpenBAT, WLC, BAT300, BAT54 prior to 8.80 and OpenBAT prior to 9.10 are shipped with identical default SSH and SSL keys that cannot be changed, allowing unauthenticated remote attackers to decrypt or intercept encrypted management communications. Attackers can perform man-in-the-middle attacks, impersonate devices, and expose sensitive information by leveraging the shared default cryptographic keys across multiple devices.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/21/2026
This vulnerability affects Hirschmann HiLCOS devices including OpenBAT, WLC, BAT300, and BAT54 models with firmware versions prior to 8.80 and OpenBAT specifically before 9.10. The security flaw stems from the inclusion of identical default SSH and SSL cryptographic keys in all affected devices, which remain unchanged throughout the device lifecycle. This design oversight creates a critical weakness in the device security architecture as these default keys are publicly known and cannot be modified by administrators. The vulnerability directly violates security best practices and represents a fundamental failure in cryptographic key management, creating a single point of failure that compromises the entire device ecosystem.
The technical implementation of this vulnerability allows unauthenticated remote attackers to exploit the shared default keys for multiple purposes including man-in-the-middle attacks, device impersonation, and decryption of encrypted management communications. When attackers obtain these default keys through public repositories or security research, they can establish unauthorized connections to affected devices, intercept sensitive data transmitted over SSL/TLS connections, and potentially gain administrative access. This weakness specifically aligns with CWE-310, which addresses cryptographic issues, and more specifically CWE-326, which covers inadequate encryption strength, while also demonstrating characteristics of CWE-798, which deals with hardcoded credentials. The vulnerability enables attackers to perform credential stuffing attacks against multiple devices simultaneously, as the same keys work across all affected models.
The operational impact of this vulnerability extends beyond simple data interception to include complete compromise of device management functions and potential network infiltration. Attackers can manipulate device configurations, access sensitive operational data, and potentially use compromised devices as entry points for broader network attacks. This vulnerability significantly increases the attack surface for organizations using these devices, as the default keys provide attackers with persistent access capabilities that remain valid across device reboots and firmware updates. The implications are particularly severe for industrial control systems and network infrastructure where these devices operate, as they often handle critical operational data and network management functions. Organizations may experience unauthorized access to device management interfaces, data exfiltration, and potential disruption of critical network operations.
Mitigation strategies should focus on immediate firmware upgrades to versions that address the hardcoded key issue, as well as network segmentation and monitoring to detect unauthorized access attempts. Organizations must implement comprehensive device inventory management to identify all affected devices and ensure timely patch deployment. Network administrators should consider implementing additional security controls such as intrusion detection systems and network access controls to limit exposure. The vulnerability highlights the importance of following security guidelines from standards such as NIST SP 800-53 and ISO 27001, which emphasize the need for proper key management and the avoidance of hardcoded credentials. Regular security audits and vulnerability assessments should be conducted to identify similar issues in other network devices, as this vulnerability demonstrates the risks associated with poor cryptographic key management practices in embedded systems and industrial network equipment.