CVE-2025-15620

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-15620
HiOS Switch Platform versions 09.1.00 through 09.4.04 and 10.0.00 through 10.3.00 contain a denial-of-service vulnerability in the web interface that allows remote attackers to reboot the affected device by sending a malicious HTTP GET request to a specific endpoint. Attackers can trigger an uncontrolled reboot condition through crafted HTTP requests to cause service disruption and unavailability of the switch.

8.6 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://assets.belden.com/m/702a656e81736b04/original/PSIRT-2_Web_Interface_HiOS.pdf Vendor Advisory
https://www.vulncheck.com/advisories/hios-switch-platform-denial-of-service-via-web-interface Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:belden:hios_switch:*:*:*:*:*:*:*:*
cpe:2.3:a:belden:hios_switch:*:*:*:*:*:*:*:*
History

05 Jun 2026, 18:06

Type Values Removed Values Added
References () https://assets.belden.com/m/702a656e81736b04/original/PSIRT-2_Web_Interface_HiOS.pdf - () https://assets.belden.com/m/702a656e81736b04/original/PSIRT-2_Web_Interface_HiOS.pdf - Vendor Advisory
References () https://www.vulncheck.com/advisories/hios-switch-platform-denial-of-service-via-web-interface - () https://www.vulncheck.com/advisories/hios-switch-platform-denial-of-service-via-web-interface - Third Party Advisory
CPE cpe:2.3:a:belden:hios_switch:*:*:*:*:*:*:*:*
First Time Belden
Belden hios Switch

26 May 2026, 00:16

Type Values Removed Values Added
Summary (en) HiOS Switch Platform versions 09.1.00 prior to 09.4.05 and 10.3.01 contains a denial-of-service vulnerability in the web interface that allows remote attackers to reboot the affected device by sending a malicious HTTP GET request to a specific endpoint. Attackers can trigger an uncontrolled reboot condition through crafted HTTP requests to cause service disruption and unavailability of the switch. (en) HiOS Switch Platform versions 09.1.00 through 09.4.04 and 10.0.00 through 10.3.00 contain a denial-of-service vulnerability in the web interface that allows remote attackers to reboot the affected device by sending a malicious HTTP GET request to a specific endpoint. Attackers can trigger an uncontrolled reboot condition through crafted HTTP requests to cause service disruption and unavailability of the switch.

03 Apr 2026, 23:17

Type Values Removed Values Added
References
  • () https://www.vulncheck.com/advisories/hios-switch-platform-denial-of-service-via-web-interface -

02 Apr 2026, 23:17

Type Values Removed Values Added
Summary (en) HiOS Switch Platform contains a denial-of-service vulnerability in the web interface that allows remote attackers to reboot the affected device by sending a malicious HTTP GET request to a specific endpoint. Attackers can trigger an uncontrolled reboot condition through crafted HTTP requests to cause service disruption and unavailability of the switch. (en) HiOS Switch Platform versions 09.1.00 prior to 09.4.05 and 10.3.01 contains a denial-of-service vulnerability in the web interface that allows remote attackers to reboot the affected device by sending a malicious HTTP GET request to a specific endpoint. Attackers can trigger an uncontrolled reboot condition through crafted HTTP requests to cause service disruption and unavailability of the switch.

02 Apr 2026, 21:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-04-02 21:16

Updated : 2026-06-05 18:06

NVD link : CVE-2025-15620

Mitre link : CVE-2025-15620

CVE.ORG link : CVE-2025-15620

JSON object : View

Products Affected

belden

  • hios_switch
CWE
CWE-306

Missing Authentication for Critical Function