CVE-2025-15620

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-15620
HiOS Switch Platform versions 09.1.00 through 09.4.04 and 10.0.00 through 10.3.00 contain a denial-of-service vulnerability in the web interface that allows remote attackers to reboot the affected device by sending a malicious HTTP GET request to a specific endpoint. Attackers can trigger an uncontrolled reboot condition through crafted HTTP requests to cause service disruption and unavailability of the switch.

8.6 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://assets.belden.com/m/702a656e81736b04/original/PSIRT-2_Web_Interface_HiOS.pdf Vendor Advisory
https://www.vulncheck.com/advisories/hios-switch-platform-denial-of-service-via-web-interface Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:belden:hios_switch:*:*:*:*:*:*:*:*
cpe:2.3:a:belden:hios_switch:*:*:*:*:*:*:*:*
History

24 Jul 2026, 21:10

Type Values Removed Values Added
Summary
  • (es) La Plataforma HiOS Switch versiones 09.1.00 anteriores a 09.4.05 y 10.3.01 contiene una vulnerabilidad de denegación de servicio en la interfaz web que permite a atacantes remotos reiniciar el dispositivo afectado enviando una solicitud HTTP GET maliciosa a un endpoint específico. Los atacantes pueden desencadenar una condición de reinicio incontrolado a través de solicitudes HTTP manipuladas para causar interrupción del servicio y falta de disponibilidad del switch.

05 Jun 2026, 18:06

Type Values Removed Values Added
First Time Belden
Belden hios Switch
References () https://assets.belden.com/m/702a656e81736b04/original/PSIRT-2_Web_Interface_HiOS.pdf - () https://assets.belden.com/m/702a656e81736b04/original/PSIRT-2_Web_Interface_HiOS.pdf - Vendor Advisory
References () https://www.vulncheck.com/advisories/hios-switch-platform-denial-of-service-via-web-interface - () https://www.vulncheck.com/advisories/hios-switch-platform-denial-of-service-via-web-interface - Third Party Advisory
CPE cpe:2.3:a:belden:hios_switch:*:*:*:*:*:*:*:*

26 May 2026, 00:16

Type Values Removed Values Added
Summary (en) HiOS Switch Platform versions 09.1.00 prior to 09.4.05 and 10.3.01 contains a denial-of-service vulnerability in the web interface that allows remote attackers to reboot the affected device by sending a malicious HTTP GET request to a specific endpoint. Attackers can trigger an uncontrolled reboot condition through crafted HTTP requests to cause service disruption and unavailability of the switch. (en) HiOS Switch Platform versions 09.1.00 through 09.4.04 and 10.0.00 through 10.3.00 contain a denial-of-service vulnerability in the web interface that allows remote attackers to reboot the affected device by sending a malicious HTTP GET request to a specific endpoint. Attackers can trigger an uncontrolled reboot condition through crafted HTTP requests to cause service disruption and unavailability of the switch.

03 Apr 2026, 23:17

Type Values Removed Values Added
References
  • () https://www.vulncheck.com/advisories/hios-switch-platform-denial-of-service-via-web-interface -

02 Apr 2026, 23:17

Type Values Removed Values Added
Summary (en) HiOS Switch Platform contains a denial-of-service vulnerability in the web interface that allows remote attackers to reboot the affected device by sending a malicious HTTP GET request to a specific endpoint. Attackers can trigger an uncontrolled reboot condition through crafted HTTP requests to cause service disruption and unavailability of the switch. (en) HiOS Switch Platform versions 09.1.00 prior to 09.4.05 and 10.3.01 contains a denial-of-service vulnerability in the web interface that allows remote attackers to reboot the affected device by sending a malicious HTTP GET request to a specific endpoint. Attackers can trigger an uncontrolled reboot condition through crafted HTTP requests to cause service disruption and unavailability of the switch.

02 Apr 2026, 21:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-02 21:16

Updated : 2026-07-24 21:10

NVD link : CVE-2025-15620

Mitre link : CVE-2025-15620

CVE.ORG link : CVE-2025-15620

JSON object : View

Products Affected

belden

  • hios_switch
CWE
CWE-306

Missing Authentication for Critical Function