The vulnerability in Hirschmann HiLCOS products allows a firewall to fail when filtering IPv4 multicast and broadcast traffic if management IP address filtering is disabled, enabling attackers to inject or observe multicast/broadcast packets that should be blocked by configured rules, thereby bypassing intended traffic restrictions. This weakness is categorized as a lack of proper authorization control (CWE-284).

Affected products include Hirschmann HiLCOS BAT867, OpenBAT, BAT450 and Wireless LAN Controller (WLC); the affected firmware or software versions are not specified in the public report.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of 0.00004 (0.004%) shows a very low but nonzero probability of exploitation. It is not listed in the CISA KEV catalog, yet the attack remains feasible for adversaries with network access. The likely attack vector is by sending malicious multicast or broadcast frames through the network when management IP address filtering is turned off, leveraging the firewall’s bypass to gain non‑authorized network traffic visibility or injection.