Critical severity · published Apr 3, 2026
CVE-2017-20237
Hirschmann Industrial HiVision Authentication Bypass Remote Code Execution
9.8
CVSS
1%
EPSS
No
On KEV
Description
Hirschmann Industrial HiVision versions prior to 06.0.07 and 07.0.03 contains an authentication bypass vulnerability in the master service that allows unauthenticated remote attackers to execute arbitrary commands with administrative privileges. Attackers can invoke exposed interface methods over the remote service to bypass authentication and achieve remote code execution on the underlying operating system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HI
Hirschmann Industrial HiVision · Belden
through 06.0.06; through 07.0.02 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-20237
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-20237
assets.belden.com
https://assets.belden.com/m/1cb01df62f1f31e3/original/Unauthenticated-Remote-Code-Execution-Security-Bulletin-Hirschmann-BSECV-2017-02.pdf
www.vulncheck.com
https://www.vulncheck.com/advisories/hirschmann-industrial-hivision-authentication-bypass-remote-code-execution
More from Hirschmann Industrial HiVision
7.8
CVE-2023-7343
Belden Industrial HiVision Arbitrary Code Execution via Malicious Project File
7.3
CVE-2022-4987
Hirschmann Industrial HiVision External Application Path Hijacking Leading to Arbitrary Code Execution
7.1
CVE-2017-20238
Hirschmann Industrial HiVision Improper Authorization Privilege Escalation