CVE-2016-15058Hirschmann HiLCOS Classic Platform Password Exposure via SNMP
Updated under an hour ago ()
Does this affect you?
It affects Belden Hirschmann HiLCOS Classic Platform. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Hirschmann HiLCOS Classic Platform switches Classic L2E, L2P, L3E, L3P versions prior to 09.0.06 and Classic L2B prior to 05.3.07 contain a credential exposure vulnerability where user passwords are synchronized with SNMPv1/v2 community strings and transmitted in plaintext when the feature is enabled. Attackers with local network access can sniff SNMP traffic or extract configuration data to recover plaintext credentials and gain unauthorized administrative access to the switches.
- CVSS
- 8.1 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Weakness (CWE)
- CWE-257
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- VulnCheck
- NVD analysis
- Awaiting Analysis
- Record last updated
- May 13, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Belden Hirschmann HiLCOS Classic Platform belden:hirschmann_hilcos_classic_platform (from the name) | from 09.0.06 not affected; from 05.3.07 not affected; through 09.0.05; through 05.3.06 | CNA record |
References
- https://assets.belden.com/m/1d8273c6205dc400/original/Security-Bulletin-Password-Sync-SNMP-v1-v2-BSECV-2016-12.pdfvendor-advisory
- https://www.kb.cert.org/vuls/id/507216
- https://www.vulncheck.com/advisories/hirschmann-hilcos-classic-platform-password-exposure-via-snmpthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.