The vulnerability arises when user passwords are synchronized with SNMPv1/v2 community strings and sent over the network in clear text. An attacker who can monitor the local network or read configuration files can capture these strings, decode the plaintext credentials, and then use them to achieve unauthorized administrative access to the device. The weakness exemplified by CWE‑257 allows a legitimate credential to be exposed by design, undermining authentication controls.

The flaw affects Belden Hirschmann HiLCOS Classic Platform switches, specifically Classic L2E, L2P, L3E, L3P releases before version 09.0.06 and Classic L2B releases before version 05.3.07. These models forward all configured passwords as SNMP community string values when the feature is enabled.

The vulnerability scores 8.6 on the CVSS base metric, indicating high severity, and it is not listed in the CISA KEV catalog. EPSS score is <1%, indicating a low likelihood of exploitation in the wild. The exploitation path requires local network access; an attacker must be able to sniff SNMP traffic or extract the device configuration. Once the attack is executed, the attacker gains full administrative rights. While remote exploitation is unlikely, any compromised local network segment poses a significant risk for routine SNMP traffic.