Vulnerability · Published Apr 2, 2026 · Assigned by VulnCheck

CVE-2024-14034Hirschmann HiEOS Authentication Bypass via HTTP Management Module

Critical 9.8

In plain English

A critical-severity improper authentication in Hirschmann HiEOS LRS11 from Belden. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)0.5%top 59.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Hirschmann HiEOS devices versions prior to 01.1.00 contain an authentication bypass vulnerability in the HTTP(S) management module that allows unauthenticated remote attackers to gain administrative access by sending specially crafted HTTP(S) requests. Attackers can exploit improper authentication handling to obtain elevated privileges and perform unauthorized actions including configuration download or upload and firmware modification.

Affected products (as reported)

Vendor	Product	Versions
Belden	Hirschmann HiEOS LRS11	0 – before 01.1.00

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Belden Security Bulletins vendor-advisory
https://www.vulncheck.com/advisories/hirschmann-hieos-authentication-bypass-via-http-management-module third-party-advisory