CVE-2015-10148

Hirschmann HiLCOS devices OpenBAT, WLC, BAT300, BAT54 prior to 8.80 and OpenBAT prior to 9.10 are shipped with identical default SSH and SSL keys that cannot be changed, allowing unauthenticated remote attackers to decrypt or intercept encrypted management communications. Attackers can perform man-in-the-middle attacks, impersonate devices, and expose sensitive information by leveraging the shared default cryptographic keys across multiple devices.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://assets.belden.com/m/76d31798e65c9f47/original/Security-Bulletin-SSH-SSL-Default-Keys-HiLCOS-Hirschmann-BSECV-2015-12.pdf
https://www.vulncheck.com/advisories/hirschmann-hilcos-hard-coded-credentials-ssh-ssl-keys

Configurations

No configuration.

History

21 Jul 2026, 07:10

Type	Values Removed	Values Added
Summary		(es) Los dispositivos Hirschmann HiLCOS OpenBAT, WLC, BAT300, BAT54 anteriores a la versión 8.80 y OpenBAT anteriores a la versión 9.10 se envían con claves SSH y SSL predeterminadas idénticas que no se pueden cambiar, lo que permite a atacantes remotos no autenticados descifrar o interceptar comunicaciones de gestión cifradas. Los atacantes pueden realizar ataques man-in-the-middle, suplantar la identidad de dispositivos y exponer información sensible al aprovechar las claves criptográficas predeterminadas compartidas en múltiples dispositivos.

03 Apr 2026, 22:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-04-03 22:16

Updated : 2026-07-21 07:10

NVD link : CVE-2015-10148

Mitre link : CVE-2015-10148

CVE.ORG link : CVE-2015-10148

JSON object : View

Products Affected

No product.

CWE

CWE-321

Use of Hard-coded Cryptographic Key

{"id": "CVE-2015-10148", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2015-10148", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-06T13:11:11.390412Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 4.2, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Belden", "product": "Hirschmann HiLCOS", "versions": [{"status": "affected", "version": "9.00", "versionType": "custom", "lessThanOrEqual": "9.00-RU1"}, {"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "8.80"}, {"status": "unaffected", "version": "9.10", "versionType": "custom"}], "defaultStatus": "affected"}]}], "published": "2026-04-03T22:16:24.207", "references": [{"url": "https://assets.belden.com/m/76d31798e65c9f47/original/Security-Bulletin-SSH-SSL-Default-Keys-HiLCOS-Hirschmann-BSECV-2015-12.pdf", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/hirschmann-hilcos-hard-coded-credentials-ssh-ssl-keys", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-321"}]}], "descriptions": [{"lang": "en", "value": "Hirschmann HiLCOS devices OpenBAT, WLC, BAT300, BAT54 prior to 8.80 and OpenBAT prior to 9.10 are shipped with identical default SSH and SSL keys that cannot be changed, allowing unauthenticated remote attackers to decrypt or intercept encrypted management communications. Attackers can perform man-in-the-middle attacks, impersonate devices, and expose sensitive information by leveraging the shared default cryptographic keys across multiple devices."}, {"lang": "es", "value": "Los dispositivos Hirschmann HiLCOS OpenBAT, WLC, BAT300, BAT54 anteriores a la versi\u00f3n 8.80 y OpenBAT anteriores a la versi\u00f3n 9.10 se env\u00edan con claves SSH y SSL predeterminadas id\u00e9nticas que no se pueden cambiar, lo que permite a atacantes remotos no autenticados descifrar o interceptar comunicaciones de gesti\u00f3n cifradas. Los atacantes pueden realizar ataques man-in-the-middle, suplantar la identidad de dispositivos y exponer informaci\u00f3n sensible al aprovechar las claves criptogr\u00e1ficas predeterminadas compartidas en m\u00faltiples dispositivos."}], "lastModified": "2026-07-21T07:10:00.117", "sourceIdentifier": "disclosure@vulncheck.com"}