The vulnerability allows authenticated users with operator or auditor roles to send specially crafted packets to the HiSecOS web server and elevate their privileges to administrator. Once an attacker gains administrator access, they can fully control the device, modify system settings, access sensitive data, and potentially use the device as a pivot point for further network attacks. The weakness, identified as controlled privilege escalation, can compromise confidentiality, integrity, and availability of the system.

Belden Hirschmann HiSecOS EAGLE devices running any web server build prior to version 04.1.00, including the 03.4.00 release and subsequent 04.0.x builds. The flaw applies to all builds below 04.1.00; no specific advisory lists additional vendors or product lines.

The CVSS score of 8.7 classifies this flaw as high severity. Exploitation requires that the attacker already possesses valid credentials with operator or auditor privileges, often limiting the threat to internal or compromised accounts. EPSS data is unavailable, and the vulnerability is not listed in the CISA KEV catalog, yet because the flaw can grant full administrative control, the risk to exposed devices remains significant.