CVE-2021-4477: Hirschmann HiLCOS Firewall Bypass Vulnerability

CVE-2021-4477 Overview

Hirschmann HiLCOS OpenBAT and BAT450 products contain a firewall bypass vulnerability in IPv6 IPsec deployments that allows traffic from VPN connections to bypass configured firewall rules. Attackers can exploit this vulnerability by establishing IPv6 IPsec connections (IKEv1 or IKEv2) while simultaneously using an IPv6 Internet connection to circumvent firewall policy enforcement.

This vulnerability represents a critical network security flaw that undermines the fundamental security controls organizations rely on to protect their network infrastructure. The improper access control (CWE-284) allows unauthorized network traffic to bypass security boundaries designed to restrict and filter communications.

Critical Impact

Attackers can bypass firewall rules on affected Hirschmann devices, potentially gaining unauthorized network access and exfiltrating sensitive data through IPv6 IPsec VPN connections.

Affected Products

• Hirschmann HiLCOS OpenBAT products with IPv6 IPsec configurations
• Hirschmann BAT450 products with IPv6 IPsec configurations
• Devices utilizing IKEv1 or IKEv2 with IPv6 Internet connectivity

Discovery Timeline

• 2026-04-03 - CVE CVE-2021-4477 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2021-4477

Vulnerability Analysis

This firewall bypass vulnerability affects the IPv6 IPsec implementation in Hirschmann HiLCOS OpenBAT and BAT450 networking products. The core issue lies in improper access control mechanisms that fail to properly enforce firewall rules when IPv6 IPsec connections are established alongside an active IPv6 Internet connection.

The vulnerability allows traffic originating from VPN connections to circumvent the configured firewall policies entirely. This creates a significant security gap where network segmentation and access control measures become ineffective, potentially exposing internal network resources to unauthorized access.

The attack can be executed remotely over the network without requiring authentication or user interaction. An attacker with network access can establish IPv6 IPsec tunnels using either IKEv1 or IKEv2 protocols to exploit this weakness. The impact includes potential compromise of confidentiality and integrity of network communications, though availability is not directly affected.

Root Cause

The root cause of this vulnerability is improper access control (CWE-284) within the IPv6 IPsec firewall implementation. The device fails to properly apply firewall rules to traffic traversing IPv6 IPsec VPN connections when an IPv6 Internet connection is simultaneously active. This design flaw allows VPN traffic to bypass the security policies that should govern all network communications through the device.

Attack Vector

The attack vector for CVE-2021-4477 involves network-based exploitation. An attacker can exploit this vulnerability by:

1. Establishing an IPv6 IPsec connection to a vulnerable Hirschmann HiLCOS OpenBAT or BAT450 device using either IKEv1 or IKEv2 protocols
2. Utilizing an active IPv6 Internet connection on the target device
3. Sending network traffic through the VPN connection that would normally be blocked by firewall rules
4. Bypassing firewall policy enforcement to access restricted network resources or exfiltrate data

The attack requires no authentication or user interaction, making it particularly dangerous for organizations relying on these devices for network security. Technical details regarding specific exploitation techniques can be found in the Belden Security Bulletin and VulnCheck Advisory.

Detection Methods for CVE-2021-4477

Indicators of Compromise

• Unexpected IPv6 IPsec tunnel establishments from unauthorized endpoints
• Network traffic patterns showing connections that should be blocked by firewall rules
• Anomalous VPN connection activity during non-business hours or from unusual geographic locations
• Log entries indicating firewall rule violations that were not properly enforced

Detection Strategies

• Monitor IPv6 IPsec connection logs for unauthorized tunnel establishments on affected Hirschmann devices
• Implement network traffic analysis to identify traffic patterns bypassing firewall policies
• Deploy intrusion detection systems (IDS) with signatures for anomalous VPN traffic behavior
• Conduct regular firewall rule validation testing to verify policy enforcement effectiveness

Monitoring Recommendations

• Enable verbose logging on affected Hirschmann HiLCOS OpenBAT and BAT450 devices for IPv6 IPsec connections
• Configure SIEM alerts for unusual VPN connection patterns or firewall bypass indicators
• Implement network flow monitoring to detect traffic that circumvents expected firewall restrictions
• Establish baseline VPN usage patterns to identify deviations that may indicate exploitation

How to Mitigate CVE-2021-4477

Immediate Actions Required

• Review and audit all IPv6 IPsec configurations on affected Hirschmann HiLCOS OpenBAT and BAT450 devices
• Consider temporarily disabling IPv6 IPsec functionality if not operationally critical until patches are applied
• Implement additional network segmentation controls external to the affected devices
• Monitor affected devices closely for signs of exploitation

Patch Information

Organizations should consult the Belden Security Bulletin BSECV-1v0 for official patch information and firmware updates. Contact Hirschmann/Belden support for the latest security patches addressing this vulnerability in HiLCOS OpenBAT and BAT450 products.

Workarounds

• Disable IPv6 IPsec functionality on affected devices if operationally feasible
• Implement external firewall controls to enforce security policies independently of the affected devices
• Use IPv4-only IPsec configurations as an alternative until patches are available
• Deploy additional network access control mechanisms upstream of vulnerable devices

# Example: Review IPv6 IPsec configuration status
# Consult Hirschmann documentation for device-specific commands
# Verify firewall rule enforcement manually
# Consider disabling IPv6 IPsec if not required:
# set ipv6-ipsec-enable no
# Always backup configurations before making changes