CVE-2021-4477

CriticalCVSS 9.1/10Last modified Jul 24, 2026

Description

Hirschmann HiLCOS OpenBAT and BAT450 products contain a firewall bypass vulnerability in IPv6 IPsec deployments that allows traffic from VPN connections to bypass configured firewall rules. Attackers can exploit this vulnerability by establishing IPv6 IPsec connections (IKEv1 or IKEv2) while simultaneously using an IPv6 Internet connection to circumvent firewall policy enforcement.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-284

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Apr 3, 2026
Last modified: Jul 24, 2026
NVD status: Awaiting Analysis

Related CVEs from 2021

CVE-2021-447756.1Cross-site scripting (XSS) issue in Website app of Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attac CVE-2021-447765.3A broken access control vulnerability in the SubNet_handler_func function of spx_restservice allows an attacker to arbitrarily change the se CVE-2021-447774.3Cross-Site Request Forgery (CSRF) vulnerabilities leading to single or bulk e-mail entries deletion discovered in Email Tracker WordPress pl CVE-2021-447799.8Unauthenticated SQL Injection (SQLi) vulnerability discovered in [GWA] AutoResponder WordPress plugin (versions <= 2.3), vulnerable at (&lis CVE-2021-44788.2Dräger CC-Vision Basic before 7.5.3 and Dräger CC-Vision E-Cal before 7.2.5.0 contain an out-of-bounds write vulnerability when loading .gdt CVE-2021-44794.0Dräger Atlan A350 versions 1.00 up to and including 1.01 contains an improper input handling vulnerability that allows attackers to cause a CVE-2021-447909.8A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). The Ap CVE-2021-447916.1In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses. Th CVE-2021-447925.3Single Connect does not perform an authorization check when using the "log-monitor" module. A remote attacker could exploit this vulnerabili CVE-2021-447938.6Single Connect does not perform an authorization check when using the sc-reports-ui" module. A remote attacker could exploit this vulnerabil CVE-2021-447945.3Single Connect does not perform an authorization check when using the "sc-diagnostic-ui" module. A remote attacker could exploit this vulner CVE-2021-447955.3Single Connect does not perform an authorization check when using the "sc-assigned-credential-ui" module. A remote attacker could exploit th