The vulnerability is an authentication bypass in the master service of Hirschmann Industrial HiVision. An attacker who can reach the device over the network can exploit exposed interface methods that ignore authentication checks, allowing the execution of arbitrary commands with administrative privileges on the underlying operating system. This flaw represents a classic implementing‐time unauthenticated remote code execution weakness (CWE‑287).

Belden Hirschmann Industrial HiVision devices running firmware versions earlier than 06.0.07 and 07.0.03 are affected. Attackers can target these versions without any credentials and gain full system control.

With a CVSS base score of 9.3 the flaw is considered critical. No EPSS data is available and the vulnerability is not listed in the CISA KEV catalog, yet the exploit path requires only network access to the exposed service and no local privileges. The lack of authentication enables attackers to reach the vulnerable interface from remote hosts, making exploitation highly plausible for an adversary with network connectivity to the device.