High severity · published Apr 3, 2026
CVE-2017-20238
Hirschmann Industrial HiVision Improper Authorization Privilege Escalation
7.1
CVSS
0.2%
EPSS
No
On KEV
Description
Hirschmann Industrial HiVision versions 06.0.00 and 07.0.00 prior to 06.0.06 and 07.0.01 contains an improper authorization vulnerability that allows read-only users to gain write access to managed devices by bypassing access control mechanisms. Attackers can exploit alternative interfaces such as the web interface or SNMP browser to modify device configurations despite having restricted permissions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HI
Hirschmann Industrial HiVision · Belden
06.0.00 through 06.0.05; through 07.00 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-20238
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-20238
assets.belden.com
https://assets.belden.com/m/7cc5d59343125b25/original/Security-Bulletin-Restricted-User-Roles-Write-Access-HiVision-2017-01.pdf
www.vulncheck.com
https://www.vulncheck.com/advisories/hirschmann-industrial-hivision-improper-authorization-privilege-escalation
More from Hirschmann Industrial HiVision
9.8
CVE-2017-20237
Hirschmann Industrial HiVision Authentication Bypass Remote Code Execution
7.8
CVE-2023-7343
Belden Industrial HiVision Arbitrary Code Execution via Malicious Project File
7.3
CVE-2022-4987
Hirschmann Industrial HiVision External Application Path Hijacking Leading to Arbitrary Code Execution