CVE-2020-37216

HighCVSS 7.5

Published: 03/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.92%

57th percentile - higher than 57% of all known CVEs

Summary

Hirschmann HiOS devices before versions 08.1.00 and 07.1.01 contain a denial of service vulnerability in the EtherNet/IP stack where improper handling of packet length fields allows remote attackers to crash or hang the device by sending specially crafted UDP EtherNet/IP packets with a length value larger than the actual packet size.

Risk Assessment

An attacker can crash the network device, causing disruption in the industrial network and potential production losses.

Recommendation

Update Hirschmann HiOS firmware to version 08.1.00 or 07.1.01 (or later).

Other vulnerabilities in Hirschmann HiOS

CVE-2026-89025High
Denial-of-service vulnerability in the integrated web server of Hirschmann HiOS Switch Platform devices. A remote unauthenticated attacker can send a specially crafted HTTP(S) request to a specific endpoint that is processed incorrectly, causing an unintended reboot and temporary denial of service. The issue is fixed in versions 07.1.12, 08.7.10, 09.0.13, 09.3.03, 10.3.08, and 10.5.00.

Original NVD description (English source)

Hirschmann HiOS devices versions prior to 08.1.00 and 07.1.01 contain a denial of service vulnerability in the EtherNet/IP stack where improper handling of packet length fields allows remote attackers to crash or hang the device. Attackers can send specially crafted UDP EtherNet/IP packets with a length value larger than the actual packet size to render the device inoperable.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS