CVE-2025-15620

HighCVSS 8.6/10Last modified Oct 29, 2026

Description

HiOS Switch Platform versions 09.1.00 through 09.4.04 and 10.0.00 through 10.3.00 contain a denial-of-service vulnerability in the web interface that allows remote attackers to reboot the affected device by sending a malicious HTTP GET request to a specific endpoint. Attackers can trigger an uncontrolled reboot condition through crafted HTTP requests to cause service disruption and unavailability of the switch.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
Belden	Hirschmann HiOS Switch Platform	>= 09.1.00, < 09.4.05; >= 10.0.00, < 10.3.01

References

https://assets.belden.com/m/702a656e81736b04/original/PSIRT-2_Web_Interface_HiOS.pdfVendor Advisory
https://www.vulncheck.com/advisories/hios-switch-platform-denial-of-service-via-web-interfaceThird Party Advisory

Timeline

Published: Apr 2, 2026
Last modified: Oct 29, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-156216.0Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 cre CVE-2025-156226.2Insufficiently Protected Credentials vulnerability in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client reveals plaintext OAuth2 cli CVE-2025-156237.5Exposure of Private Personal Information to an Unauthorized Actor, : Exposure of Sensitive System Information to an Unauthorized Control Sph CVE-2025-156247.5Plaintext Storage of a Password vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server. In a setup where OpenID is used as the prim CVE-2025-156259.8Unauthenticated user is able to execute arbitrary SQL commands in Sparx Pro Cloud Server database in certain cases.CVE-2025-156265.3Authenticated user can bypass authorization in Ribblr - Crochet & Knitting iOS application CVE-2025-156277.5A cryptographic weakness exists in the Omada adoption protocol. The protocol relies on hard-coded cryptographic keys to establish trust and CVE-2025-156287.5Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between controllers and managed d CVE-2025-156297.5A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect communications between controll CVE-2025-156305.9A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with the adoption workflow CVE-2025-156315.9A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does no CVE-2025-156323.5A vulnerability has been found in 1Panel-dev MaxKB up to 2.4.2. Impacted is an unknown function of the file ui/src/chat.ts of the component