PatchSiren cyber security CVE debrief
CVE-2015-10148 Belden CVE debrief
CVE-2015-10148 involves Hirschmann HiLCOS devices including OpenBAT, WLC, BAT300, and BAT54. These devices, along with OpenBAT, have a critical vulnerability. They are shipped with identical default SSH and SSL keys that cannot be changed. This allows unauthenticated remote attackers to decrypt or intercept encrypted management communications. The vulnerability enables attackers to perform man-in-the-middle attacks, impersonate devices, and expose sensitive information by leveraging the shared default cryptographic keys across multiple devices.
- Vendor
- Belden
- Product
- Hirschmann HiLCOS
- CVSS
- HIGH 8.8
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-04-03
- Original CVE updated
- 2026-07-21
- Advisory published
- 2026-04-03
- Advisory updated
- 2026-07-21
Who should care
Organizations using Hirschmann HiLCOS devices OpenBAT, WLC, BAT300, BAT54 prior to version 8.80 and OpenBAT prior to version 9.10 should be aware of this vulnerability. Given the high CVSS score of 8.8, indicating a high severity, immediate attention is required to mitigate potential risks.
Technical summary
The vulnerability in Hirschmann HiLCOS devices stems from the use of identical default SSH and SSL keys that cannot be changed. This allows attackers to decrypt or intercept encrypted communications. The devices affected include OpenBAT, WLC, BAT300, BAT54 prior to version 8.80, and OpenBAT prior to version 9.10. The vulnerability can be exploited to perform man-in-the-middle attacks, impersonate devices, and expose sensitive information.
Defensive priority
High priority should be given to updating Hirschmann HiLCOS devices to versions that allow for the change of default SSH and SSL keys. Until then, compensating controls such as monitoring for unusual activity and restricting access to management interfaces should be considered.
Recommended defensive actions
- Update Hirschmann HiLCOS devices OpenBAT, WLC, BAT300, BAT54 to version 8.80 or later and OpenBAT to version 9.10 or later.
- Implement compensating controls such as monitoring for unusual activity and restricting access to management interfaces.
- Consider replacing devices with ones that support key changes to mitigate the risk of man-in-the-middle attacks and unauthorized access.
- Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
- Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
- Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
- Check relevant monitoring, detection, and logs for exposed assets that need extra review.
Evidence notes
The CVE record was published on 2026-04-03T22:16:24.207Z and was last modified on 2026-07-21T07:10:00.117Z. The NVD entry is currently Awaiting Analysis. References include a security bulletin from Belden and an advisory from Vulncheck.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-03T22:16:24.207Z and has not been modified since then. The NVD entry is currently Awaiting Analysis.