CVE-2024-14034 CRITICAL

CVE-2024-14034: Hirschmann HiEOS Authentication Bypass via HTTP Management Module

Vendor Belden
Product Hirschmann HiEOS LRS11
Weakness CWE-287 · Improper authentication
Published April 2, 2026
Last update May 14, 2026
View on NVD All CVEs

CVSS base score

9.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Hirschmann HiEOS devices versions prior to 01.1.00 contain an authentication bypass vulnerability in the HTTP(S) management module that allows unauthenticated remote attackers to gain administrative access by sending specially crafted HTTP(S) requests. Attackers can exploit improper authentication handling to obtain elevated privileges and perform unauthorized actions including configuration download or upload and firmware modification.

Key dates

02Disclosure timeline

April 2, 2026 CVE published
May 14, 2026 Record updated