CVE-2021-4477 PUBLISHED

Hirschmann HiLCOS OpenBAT BAT450 IPv6 IPsec Firewall Bypass

Assigner: VulnCheck
Reserved: 03.04.2026 Published: 03.04.2026 Updated: 03.04.2026

Hirschmann HiLCOS OpenBAT and BAT450 products contain a firewall bypass vulnerability in IPv6 IPsec deployments that allows traffic from VPN connections to bypass configured firewall rules. Attackers can exploit this vulnerability by establishing IPv6 IPsec connections (IKEv1 or IKEv2) while simultaneously using an IPv6 Internet connection to circumvent firewall policy enforcement.

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS Score: 9.3

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	None
Attack Complexity	Low	Integrity	High	Integrity	None
Attack Requirements	None	Availability	None	Availability	None
Privileges Required	None
User Interaction	None

CVSS 4.0

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS Score: 9.1

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Belden
Product	Hirschmann HiLCOS OpenBAT
Versions	Default: unaffected Version 3.80-REL is affected Version 8.90-REL is affected Version 9.00-REL is affected Version 9.00-RU1 is affected Version 9.10-REL is affected Version 9.12-REL is affected Version 9.12-RU1 is affected Version 9.12-RU2 is affected Version 9.12-RU3 is affected Version 9.12-RU4 is affected Version 9.12-RU5 is affected Version 9.12-RU6 is affected Version 9.12-RU7 is affected Version 9.12-RU8 is affected Version 9.12-RU9 is affected Version 9.13-REL is affected Version 9.13-RU1 is affected Version 10.12-REL is affected Version 10.12-RU1 is affected Version 10.12-RU2 is unaffected

References

Problem Types

CWE-284 Improper access control CWE