Hirschmann HiEOS LRS11 devices running versions before 01.1.00 contain an improper authentication vulnerability (CWE-287) in their HTTP(S) management interface. This allows remote attackers without any privileges to bypass authentication controls by crafting specific HTTP(S) requests, resulting in administrative access. Attackers can then perform unauthorized actions such as downloading or uploading device configurations and modifying firmware. The vulnerability is critical with a CVSS 3.1 base score of 9.8, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation grants unauthenticated attackers full administrative access to affected Hirschmann HiEOS LRS11 devices. This enables unauthorized configuration changes and firmware modifications, potentially leading to complete device compromise, disruption of network operations, and persistent malicious control. The vulnerability affects device confidentiality, integrity, and availability at a critical level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to the management interface to trusted administrators only and monitor for unusual HTTP(S) requests targeting the device. Avoid exposing the management interface to untrusted networks.