Belden vulnerabilities
50 vulnerabilities
Known vulnerabilities in Belden products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 165 products.
Products
50 of 165- Hirschmann Hios16 vulnerabilities
- Garrettcom Magnum Dx940E11 vulnerabilities
- Tofino Xenon Security Appliance9 vulnerabilities
- Eagle 20 Tofino 943 987 501 Tx\/Tx6 vulnerabilities
- Eagle 20 Tofino 943 987 502 Tx\/Mm6 vulnerabilities
- Eagle 20 Tofino 943 987 504 Mm\/Tx6 vulnerabilities
- Eagle 20 Tofino 943 987 505 Mm\/Mm6 vulnerabilities
- Tofino Argon Fa Tsa 100 Tx\/Tx6 vulnerabilities
- Tofino Argon Fa Tsa 220 Mm\/Mm6 vulnerabilities
- Tofino Argon Fa Tsa 220 Mm\/Tx6 vulnerabilities
- Tofino Argon Fa Tsa 220 Tx\/Mm6 vulnerabilities
- Tofino Argon Fa Tsa 220 Tx\/Tx6 vulnerabilities
- Hirschmann M1 8Mm Sc5 vulnerabilities
- Hirschmann M1 8Sfp5 vulnerabilities
- Hirschmann M1 8Sm Sc5 vulnerabilities
- Hirschmann M1 8Tp Rj455 vulnerabilities
- Hirschmann Mach102 24Tp F5 vulnerabilities
- Hirschmann Mach102 24Tp Fr5 vulnerabilities
- Hirschmann Mach102 8Tp5 vulnerabilities
- Hirschmann Mach102 8Tp F5 vulnerabilities
- Hirschmann Mach102 8Tp Fr5 vulnerabilities
- Hirschmann Mach102 8Tp R5 vulnerabilities
- Hirschmann Mach104 16Tx Poep5 vulnerabilities
- Hirschmann Mach104 16Tx Poep E5 vulnerabilities
- Hirschmann Mach104 16Tx Poep E L3P5 vulnerabilities
- Hirschmann Mach104 16Tx Poep R5 vulnerabilities
- Hirschmann Mach104 16Tx Poep R L3P5 vulnerabilities
- Hirschmann Mach104 16Tx Poep \+2X5 vulnerabilities
- Hirschmann Mach104 16Tx Poep \+2X E5 vulnerabilities
- Hirschmann Mach104 16Tx Poep \+2X E L3P5 vulnerabilities
- Hirschmann Mach104 16Tx Poep \+2X R5 vulnerabilities
- Hirschmann Mach104 16Tx Poep \+2X R L3P5 vulnerabilities
- Hirschmann Mach104 16Tx Poep \+2X L3P5 vulnerabilities
- Hirschmann Mach104 16Tx Poep L3P5 vulnerabilities
- Hirschmann Mach104 20Tx F5 vulnerabilities
- Hirschmann Mach104 20Tx F 4Poe5 vulnerabilities
- Hirschmann Mach104 20Tx F L3P5 vulnerabilities
- Hirschmann Mach104 20Tx Fr5 vulnerabilities
- Hirschmann Mach104 20Tx Fr L3P5 vulnerabilities
- Hirschmann Mach4002 24G L2P5 vulnerabilities
- Hirschmann Mach4002 24G L3E5 vulnerabilities
- Hirschmann Mach4002 24G L3P5 vulnerabilities
- Hirschmann Mach4002 24G\+3X L2P5 vulnerabilities
- Hirschmann Mach4002 24G\+3X L3E5 vulnerabilities
- Hirschmann Mach4002 24G\+3X L3P5 vulnerabilities
- Hirschmann Mach4002 48G L2P5 vulnerabilities
- Hirschmann Mach4002 48G L3E5 vulnerabilities
- Hirschmann Mach4002 48G L3P5 vulnerabilities
- Hirschmann Mach4002 48G\+3X L2P5 vulnerabilities
- Hirschmann Mach4002 48G\+3X L3E5 vulnerabilities
CVE-2018-25237beldenhirschmann hisecos classic firewall (eagle, eagle one)
EPSS score0.82%
Hirschmann HiSecOS devices versions prior to 05.3.03 contain a buffer overflow vulnerability in the HTTPS login interface when RADIUS authentication is enabled that allows remote attackers to crash the device or execute arbitrary code by submitting a password longer than 128 characters. Attackers can exploit improper bounds checking in password handling to overflow a fixed-size buffer and achieve denial of service or remote code execution.CVE-2018-25236beldenhirschmann_hios+1EPSS score0.50%
Hirschmann HiOS and HiSecOS products RSP, RSPE, RSPS, RSPL, MSP, EES, EESX, GRS, OS, RED, EAGLE contain an authentication bypass vulnerability in the HTTP(S) management module that allows unauthenticated remote attackers to gain administrative access by crafting specially formed HTTP requests. Attackers can exploit improper authentication handling to obtain the authentication status and privileges of a previously authenticated user without providing valid credentials.CVE-2018-5469beldenhirschmann_m1-8mm-sc+133EPSS score2.84%
An Improper Restriction of Excessive Authentication Attempts issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches. An improper restriction of excessive authentication vulnerability in the web interface has been identified, which may allow an attacker to brute force authentication.CVE-2018-5465beldenhirschmann_m1-8mm-sc+133EPSS score1.72%
A Session Fixation issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches. A session fixation vulnerability in the web interface has been identified, which may allow an attacker to hijack web sessions.CVE-2018-5461beldenhirschmann_m1-8mm-sc+133EPSS score0.44%
An Inadequate Encryption Strength issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches. An inadequate encryption strength vulnerability in the web interface has been identified, which may allow an attacker to obtain sensitive information through a successful man-in-the-middle attack.CVE-2018-5471beldenhirschmann_m1-8mm-sc+133EPSS score0.96%
A Cleartext Transmission of Sensitive Information issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches. A cleartext transmission of sensitive information vulnerability in the web interface has been identified, which may allow an attacker to obtain sensitive information through a successful man-in-the-middle attack.CVE-2018-5467beldenhirschmann_m1-8mm-sc+133EPSS score1.28%
An Information Exposure Through Query Strings in GET Request issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS, and OCTOPUS Classic Platform Switches. An information exposure through query strings vulnerability in the web interface has been identified, which may allow an attacker to impersonate a legitimate user.CVE-2021-4477beldenhirschmann hilcos openbatEPSS score0.32%
Hirschmann HiLCOS OpenBAT and BAT450 products contain a firewall bypass vulnerability in IPv6 IPsec deployments that allows traffic from VPN connections to bypass configured firewall rules. Attackers can exploit this vulnerability by establishing IPv6 IPsec connections (IKEv1 or IKEv2) while simultaneously using an IPv6 Internet connection to circumvent firewall policy enforcement.CVE-2021-27734beldenhirschmann_hios+1EPSS score1.26%
Hirschmann HiOS 07.1.01, 07.1.02, and 08.1.00 through 08.5.xx and HiSecOS 03.3.00 through 03.5.01 allow remote attackers to change the credentials of existing users.CVE-2021-30065beldeneagle_20_tofino_943_987-501-tx\/tx_firmware+12EPSS score0.88%
On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, crafted ModBus packets can bypass the ModBus enforcer. NOTE: this issue exists because of an incomplete fix of CVE-2017-11401.CVE-2021-30062beldeneagle_20_tofino_943_987-501-tx\/tx_firmware+10EPSS score0.88%
On Schneider Electric ConneXium Tofino OPCLSM TCSEFM0000 before 03.23 and Belden Tofino Xenon Security Appliance, crafted OPC packets can bypass the OPC enforcer.CVE-2021-30063beldeneagle_20_tofino_943_987-501-tx\/tx_firmware+10EPSS score1.00%
On Schneider Electric ConneXium Tofino OPCLSM TCSEFM0000 before 03.23 and Belden Tofino Xenon Security Appliance, crafted OPC packets can cause an OPC enforcer denial of service.CVE-2021-30061beldeneagle_20_tofino_943_987-501-tx\/tx_firmware+12EPSS score0.41%
On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, physically proximate attackers can execute code via a crafted file on a USB stick.CVE-2021-30064beldeneagle_20_tofino_943_987-501-tx\/tx_firmware+12EPSS score0.90%
On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, an SSH login can succeed with hardcoded default credentials (if the device is in the uncommissioned state).CVE-2021-30066beldeneagle_20_tofino_943_987-501-tx\/tx_firmware+12EPSS score0.25%
On Schneider Electric ConneXium Tofino Firewall TCSEFEA23F3F22 before 03.23, TCSEFEA23F3F20/21, and Belden Tofino Xenon Security Appliance, an arbitrary firmware image can be loaded because firmware signature verification (for a USB stick) can be bypassed. NOTE: this issue exists because of an incomplete fix of CVE-2017-11400.CVE-2015-10148beldenhirschmann hilcosEPSS score0.29%
Hirschmann HiLCOS devices OpenBAT, WLC, BAT300, BAT54 prior to 8.80 and OpenBAT prior to 9.10 are shipped with identical default SSH and SSL keys that cannot be changed, allowing unauthenticated remote attackers to decrypt or intercept encrypted management communications. Attackers can perform man-in-the-middle attacks, impersonate devices, and expose sensitive information by leveraging the shared default cryptographic keys across multiple devices.CVE-2016-2509beldenhirschmann_firmware+1EPSS score0.80%
The password-sync feature on Belden Hirschmann Classic Platform switches L2B before 05.3.07 and L2E, L2P, L3E, and L3P before 09.0.06 sets an SNMP community to the same string as the administrator password, which allows remote attackers to obtain sensitive information by sniffing the network.CVE-2016-15058beldenhirschmann hilcos classic platformEPSS score0.21%
Hirschmann HiLCOS Classic Platform switches Classic L2E, L2P, L3E, L3P versions prior to 09.0.06 and Classic L2B prior to 05.3.07 contain a credential exposure vulnerability where user passwords are synchronized with SNMPv1/v2 community strings and transmitted in plaintext when the feature is enabled. Attackers with local network access can sniff SNMP traffic or extract configuration data to recover plaintext credentials and gain unauthorized administrative access to the switches.CVE-2025-70545beldenppc_2k05x_firmwareEPSS score0.35%
A stored cross-site scripting (XSS) vulnerability exists in the web management interface of the PPC (Belden) ONT 2K05X router running firmware v1.1.9_206L. The Common Gateway Interface (CGI) component improperly handles user-supplied input, allowing a remote, unauthenticated attacker to inject arbitrary JavaScript that is persistently stored and executed when the affected interface is accessed.CVE-2025-15620beldenhios_switch+1EPSS score0.51%
HiOS Switch Platform versions 09.1.00 through 09.4.04 and 10.0.00 through 10.3.00 contain a denial-of-service vulnerability in the web interface that allows remote attackers to reboot the affected device by sending a malicious HTTP GET request to a specific endpoint. Attackers can trigger an uncontrolled reboot condition through crafted HTTP requests to cause service disruption and unavailability of the switch.