The vulnerability resides in the HiSecOS web server used in Belden Hirschmann Industrial HiVision devices. Versions 05.0.00 through 08.3.01 allow an authenticated user with either operator or auditor permissions to send specially crafted packets that cause the server to upgrade the user’s role to administrator. This elevation provides full control over the device, enabling any actions that an administrator can perform, potentially including configuration changes, firmware updates, or other privileged operations. The weakness is a privilege escalation condition listed as CWE‑269.

Affected devices are Belden Hirschmann Industrial HiVision products running the HiSecOS operating system. The flaw affects HiSecOS web server releases from 05.0.00 up to and including 08.3.01. Users running any of those firmware versions should check the vendor advisory for an update. No other products or versions are mentioned.

The CVSS score is 8.5, indicating high severity. No EPSS score is available, and the vulnerability is not yet listed in CISA’s KEV catalog. Exploitation would require an attacker to be authenticated as a user with operator or auditor roles, typically accessed over the network that can reach the web server. Once the crafted packets are sent, the privilege level is raised, after which the attacker can perform any administrative function. Because the flaw is limited to authenticated users, initial compromise or access to the system is needed, but once achieved, the risk of full administrative takeover is significant.