The flaw in the HiOS Switch Platform web interface lets a remote attacker send a crafted HTTP GET request to a specific endpoint, causing the device to reboot automatically. Because no authentication or input validation is performed, the endpoint accepts arbitrary requests, resulting in an uncontrolled reboot that brings the switch offline for an indeterminate period. This is a classic input validation vulnerability (CWE-306) that leads to a denial-of-service scenario.

Affected products are the Belden Hirschmann HiOS Switch Platform. Versions 09.1.00 up through 09.4.04 and the 10.3.01 release contain the flaw. Firmware releases 09.4.05 and later, and any newer 10.3.x releases, are not susceptible.

With a CVSS score of 9.2, the vulnerability is considered critical. An attacker can exploit it simply by sending a malicious HTTP GET request over the network to the vulnerable endpoint, with no credentials required. EPSS data is not available, and the flaw is not listed in the CISA KEV catalog, but the high severity score and the ease of exploitation mean that any network exposed to the switch’s web interface is at risk of abrupt service disruption. Timely patching or network segmentation is essential to mitigate potential downtime.