CVE-2021-4477

Estado: Pendiente de análisisCrítica (9.3)—

Hirschmann HiLCOS OpenBAT and BAT450 products contain a firewall bypass vulnerability in IPv6 IPsec deployments that allows traffic from VPN connections to bypass configured firewall rules. Attackers can exploit this vulnerability by establishing IPv6 IPsec connections (IKEv1 or IKEv2) while simultaneously using an IPv6 Internet connection to circumvent firewall policy enforcement.

CVSS

Versión: 4.0
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Puntuación base: 9.3

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.32%
Percentil entre todas las CVEs puntuadas: 23
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access75 %
Impacto principalT1090.004 Domain Frontingcommand and control70 %
Impacto secundarioT1499.004 Application or System Exploitationimpact55 %

Firewall bypass en red pública (AV:N, PR:N) mediante IPv6 IPsec; impactos: proxy/SSRF (tráfico desviado) y potencial DoS por congestión de tráfico VPN no filtrado.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network Traffic Vulnerability Scanning SSL/TLS Inspection Privileged Account Management Network Segmentation Limit Access to Resource Over Network

Tecnologías afectadas (3)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Hirschmann — Bat450^AI Hirschmann — Hilcos^AI Hirschmann — Openbat^AI

CWE

CWE-284

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2021-4477",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2021-4477",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-04-06T13:16:56.315497Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "disclosure@vulncheck.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "disclosure@vulncheck.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 9.3,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "disclosure@vulncheck.com",
      "affectedData": [
        {
          "vendor": "Belden",
          "product": "Hirschmann HiLCOS OpenBAT",
          "versions": [
            {
              "status": "affected",
              "version": "3.80-REL",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "8.90-REL",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "9.00-REL",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "9.00-RU1",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "9.10-REL",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "9.12-REL",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "9.12-RU1",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "9.12-RU2",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "9.12-RU3",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "9.12-RU4",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "9.12-RU5",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "9.12-RU6",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "9.12-RU7",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "9.12-RU8",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "9.12-RU9",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "9.13-REL",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "9.13-RU1",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "10.12-REL",
              "versionType": "custom"
            },
            {
              "status": "affected",
              "version": "10.12-RU1",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "10.12-RU2",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-04-03T23:17:01.043",
  "references": [
    {
      "url": "https://assets.belden.com/m/5fd1a50fa50cb252/original/Belden-Security-Bulletin-BSECV-1v0-2019-09.pdf",
      "source": "disclosure@vulncheck.com"
    },
    {
      "url": "https://www.vulncheck.com/advisories/hirschmann-hilcos-openbat-bat450-ipv6-ipsec-firewall-bypass",
      "source": "disclosure@vulncheck.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "disclosure@vulncheck.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Hirschmann HiLCOS OpenBAT and BAT450 products contain a firewall bypass vulnerability in IPv6 IPsec deployments that allows traffic from VPN connections to bypass configured firewall rules. Attackers can exploit this vulnerability by establishing IPv6 IPsec connections (IKEv1 or IKEv2) while simultaneously using an IPv6 Internet connection to circumvent firewall policy enforcement."
    },
    {
      "lang": "es",
      "value": "Los productos Hirschmann HiLCOS OpenBAT y BAT450 contienen una vulnerabilidad de omisión de cortafuegos en implementaciones IPv6 IPsec que permite que el tráfico de las conexiones VPN omita las reglas de cortafuegos configuradas. Los atacantes pueden explotar esta vulnerabilidad al establecer conexiones IPv6 IPsec (IKEv1 o IKEv2) mientras utilizan simultáneamente una conexión a Internet IPv6 para eludir la aplicación de la política del cortafuegos."
    }
  ],
  "lastModified": "2026-07-24T22:10:00.140",
  "sourceIdentifier": "disclosure@vulncheck.com"
}