A flaw in the HiSecOS web server running on Belden Hirschmann Industrial HiVision allows authenticated users assigned the operator or auditor role to elevate their privileges to administrator by sending specially crafted packets. Once privileges are escalated, an attacker gains full control over the affected device.

Vulnerable firmware versions range from 5.0.0 to 8.3.1 on the HiSecOS web server. The issue is resolved in firmware 8.3.2 and later, which removes the privilege escalation path. Devices running earlier versions should be identified and updated accordingly.

The CVSS score of 7.8 indicates a high severity risk, yet the EPSS score of less than 1% suggests a low probability of exploitation and the vulnerability is not listed in the KEV catalog. Attackers must first authenticate as an operator or auditor and then transmit malicious packets to the web server; while the precise network channel is not specified, it is inferred that exposure occurs over the remote web interface as the packets are sent to the server. Because the flaw requires pre‑existing credentials, the overall risk is moderate but the consequences of a successful exploit are serious if an attacker gains administrator access.