Hirschmann HiLCOS OpenBAT and BAT450 devices have a flaw that lets attackers avoid firewall configurations when they set up IPv6 IPsec VPN connections. The CVE allows an adversary to create IKEv1 or IKEv2 sessions that carry traffic directly into the protected network, effectively bypassing any packet filtering rules. This can expose internal hosts to undetected intrusion or data exfiltration because the firewall no longer sees the packets as originating from a prohibited source.

Devices from Hirschmann under the HiLCOS OpenBAT line, including the BAT450 series. The vulnerability is present in all firmware versions of these models that still support IPv6 IPsec.

With a CVSS score of 9.3 the issue is considered critical. Exploitation requires only the ability to negotiate an IPv6 IPsec connection, which is typically achievable with remote network access and legitimate VPN credentials. Attackers can manipulate the connection parameters, so the exploit does not need privileged local access. The vulnerability is not listed in the CISA KEV catalog, and no EPSS score is available, but the high severity indicates a strong potential for real-world attacks.