Critical severity · published Apr 2, 2026
CVE-2024-14034
Hirschmann HiEOS Authentication Bypass via HTTP Management Module
9.8
CVSS
0.5%
EPSS
No
On KEV
Description
Hirschmann HiEOS devices versions prior to 01.1.00 contain an authentication bypass vulnerability in the HTTP(S) management module that allows unauthenticated remote attackers to gain administrative access by sending specially crafted HTTP(S) requests. Attackers can exploit improper authentication handling to obtain elevated privileges and perform unauthorized actions including configuration download or upload and firmware modification.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HH
Hirschmann HiEOS LRS11 · Belden
before 01.1.00 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-14034
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-14034
assets.belden.com
https://assets.belden.com/m/7ec5c6da25ef288/original/Belden_Security_Bulletin_BSECV-2024-02_1v0.pdf
www.vulncheck.com
https://www.vulncheck.com/advisories/hirschmann-hieos-authentication-bypass-via-http-management-module