CVE-2021-27734

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Hirschmann HiOS 07.1.01, 07.1.02, and 08.1.00 through 08.5.xx and HiSecOS 03.3.00 through 03.5.01 allow remote attackers to change the credentials of existing users.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: May 17, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-277366.5FusionAuth fusionauth-samlv2 before 0.5.4 allows XXE attacks via a forged AuthnRequest or LogoutRequest because parseFromBytes uses javax.xm CVE-2021-277377.5Apache Traffic Server 9.0.0 is vulnerable to a remote DOS attack on the experimental Slicer plugin.CVE-2021-277387.5All request mappings in `StreamingCoordinatorController.java` handling `/kylin/api/streaming_coordinator/*` REST API endpoints did not inclu CVE-2021-277419.1" Security vulnerability in HCL Commerce Management Center allowing XML external entity (XXE) injection"CVE-2021-277465.4"HCL Connections Security Update for Reflected Cross-Site Scripting (XSS) Vulnerability"CVE-2021-277513.3HCL Commerce is affected by an Insufficient Session Expiration vulnerability. After the session expires, in some circumstances, parts of the CVE-2021-277535.5"Sametime Android PathTraversal Vulnerability"CVE-2021-277555.5"Sametime Android potential path traversal vulnerability when using File class"CVE-2021-277567.5"TLS-RSA cipher suites are not disabled in BigFix Compliance up to v2.0.5. If TLS 2.0 and secure ciphers are not enabled then an attacker ca CVE-2021-277577.5" Insecure password storage issue.The application stores sensitive information in cleartext within a resource that might be accessible to an CVE-2021-277586.5There is a security vulnerability in login form related to Cross-site Request Forgery which prevents user to login after attacker spam to lo CVE-2021-277596.5This vulnerability arises because the application allows the user to perform some sensitive action without verifying that the request was se