Executive Summary
Hirschmann HiLCOS products OpenBAT, BAT450, WLC, BAT867 contains a firewall filtering vulnerability that fails to correctly filter IPv4 multicast and broadcast traffic when management IP address filtering is disabled, allowing configured filter rules to be bypassed. Attackers with network access can inject or observe multicast and broadcast packets that should have been blocked by the firewall.
Quantitative Risk Analysis
Attack Vector Profile
The payload vectors broken down by magnitude impact and ease-of-deployment factor mapping.
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NWhat This Means For Your System
Each point below is derived directly from this CVE's CVSS v3.1 vector — not editorial opinion.
Requires the attacker to be on the same network segment (LAN/VPN) as the target.
No special preconditions — the attack is reliably repeatable.
No authentication required — unauthenticated attackers can exploit directly.
No user interaction required — the attacker acts autonomously.
Successful exploitation causes: partial information disclosure, limited data modification.
OsVault Risk Score Methodology
The OsVault composite score is a 5-layer non-linear engine — not a simple weighted average. Each input signal is transformed through mathematically appropriate curves before blending, ensuring that exploitability context overrides raw severity when warranted.
Layer 1 (Technical): CVSS is mapped through a piecewise exponential curve with 4 bands (LOW 0–20, MEDIUM 20–55, HIGH 55–85, CRITICAL 85–100), then multiplied by full CVSS vector decomposition factors for Attack Vector, Complexity, Privileges, and User Interaction.
Layer 2 (Threat): Raw EPSS is passed through a logistic sigmoid (k=40, midpoint=0.05) to maximize discrimination in the decision-relevant range. The result is added to an exploit maturity tier base score (Weaponized: 85, Functional: 55, PoC: 40, Unproven: 18).
Layer 3 (KEV Floor):Any CVE in CISA's catalog receives a hard minimum of 93.0 (Functional) or 97.0 (Weaponized). This ensures confirmed exploitation is never buried by low CVSS scores.
Scores ≥70: patch immediately. 40–69: schedule within current sprint. Below 40: standard maintenance cycle.