CVE-2016-15058 in Hirschmann HiLCOS Classic Platform
Summary
by MITRE • 04/04/2026
Hirschmann HiLCOS Classic Platform switches Classic L2E, L2P, L3E, L3P versions prior to 09.0.06 and Classic L2B prior to 05.3.07 contain a credential exposure vulnerability where user passwords are synchronized with SNMPv1/v2 community strings and transmitted in plaintext when the feature is enabled. Attackers with local network access can sniff SNMP traffic or extract configuration data to recover plaintext credentials and gain unauthorized administrative access to the switches.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/21/2026
The vulnerability identified as CVE-2016-15058 affects Hirschmann HiLCOS Classic Platform switches across multiple product lines including L2E, L2P, L3E, L3P versions prior to 09.0.06 and L2B prior to 05.3.07. This credential exposure flaw represents a critical security weakness that directly violates fundamental principles of network security and access control. The vulnerability stems from the improper synchronization of user passwords with SNMPv1/v2 community strings, creating a dangerous configuration where administrative credentials become exposed through network traffic.
The technical implementation of this vulnerability involves the automatic synchronization feature that binds user account passwords to SNMP community strings without proper cryptographic protection. When this feature is enabled, all authentication credentials are transmitted in plaintext format over the network, making them immediately accessible to any attacker with local network access. This design flaw creates a direct pathway for credential theft through network sniffing operations, where attackers can capture SNMP packets containing the plaintext passwords. The vulnerability specifically targets the SNMP protocol implementation within these network switches, leveraging the inherent weaknesses of SNMPv1 and SNMPv2 which lack built-in encryption mechanisms.
From an operational impact perspective, this vulnerability provides attackers with immediate unauthorized administrative access to affected switches, potentially enabling them to modify network configurations, implement man-in-the-middle attacks, or establish persistent access points within the network infrastructure. The exposure affects network management and security operations as it allows attackers to bypass traditional authentication mechanisms and gain control over critical network devices. Organizations relying on these switches for network segmentation, access control, or security policy enforcement face significant risk of network compromise, particularly in environments where network monitoring is insufficient or where attackers have physical or logical access to network segments.
The vulnerability aligns with CWE-312 (Cleartext Storage of Sensitive Information) and CWE-310 (Cleartext Transmission of Sensitive Information) categories, representing a fundamental failure in secure credential handling and network communication protocols. From an ATT&CK framework perspective, this vulnerability maps to T1078 (Valid Accounts) and T1566 (Phishing) techniques, as it enables attackers to obtain valid administrative credentials through network reconnaissance and traffic interception. The attack vector requires only local network access, making it particularly dangerous in environments where network segmentation is inadequate or where attackers can position themselves within the same broadcast domain. Organizations should implement immediate mitigations including disabling the problematic synchronization feature, enforcing network segmentation, and deploying network monitoring solutions to detect and prevent SNMP traffic interception. Additionally, upgrading to supported firmware versions that address this vulnerability should be prioritized as the primary remediation strategy to ensure proper credential protection and network security posture.