CVE-2022-4987: Hirschmann HiVision RCE Vulnerability

CVE-2022-4987 Overview

CVE-2022-4987 is a path hijacking vulnerability affecting Hirschmann Industrial HiVision, a network management software used in industrial control system (ICS) environments. The vulnerability exists in versions 08.1.03 prior to 08.1.04 and version 08.2.00, specifically within the execution mechanism for user-configured external applications. Due to insufficient path sanitization, an attacker with local access can place a malicious binary in the execution path, causing it to be executed instead of the intended application. This can result in arbitrary code execution with elevated privileges depending on the context of the external application.

Critical Impact

Local attackers can achieve arbitrary code execution with potentially elevated privileges by exploiting insufficient path sanitization in external application execution, posing significant risks to industrial control system environments.

Affected Products

• Hirschmann Industrial HiVision version 08.1.03 (prior to 08.1.04)
• Hirschmann Industrial HiVision version 08.2.00

Discovery Timeline

• 2026-04-03 - CVE-2022-4987 published to NVD
• 2026-04-07 - Last updated in NVD database

Technical Details for CVE-2022-4987

Vulnerability Analysis

This vulnerability is classified under CWE-426 (Untrusted Search Path), which occurs when an application searches for executable files or libraries in directories that can be controlled by an attacker. In the context of Hirschmann Industrial HiVision, the software allows administrators to configure external applications for integration with the network management platform. When these external applications are invoked, the software fails to properly validate and sanitize the execution path, creating an opportunity for path hijacking attacks.

The local attack vector requires an attacker to have access to the system where HiVision is installed. Once access is obtained, the attacker can place a malicious executable in a location that takes precedence in the search path over the legitimate application. When HiVision attempts to launch the configured external application, the malicious binary is executed instead. The impact is significant because HiVision operates in industrial environments where it manages network infrastructure, and code execution in this context could compromise the integrity of industrial control systems.

Root Cause

The root cause of this vulnerability is insufficient path sanitization in the external application execution mechanism. The software does not properly validate or restrict the search path when launching user-configured external applications, allowing an attacker to inject a malicious binary into the search path. This is a classic instance of an untrusted search path vulnerability where the application trusts the system's path resolution without implementing additional security controls.

Attack Vector

The attack requires local access to the system running Hirschmann Industrial HiVision. An attacker must:

1. Gain local access to the target system (either through legitimate credentials or another compromise)
2. Identify a configured external application within HiVision
3. Place a malicious executable in a directory that appears earlier in the search path than the legitimate application
4. Wait for or trigger the execution of the external application through HiVision

When the external application is invoked, the operating system's path resolution mechanism finds the malicious binary first, executing it with the same privileges as the HiVision process or the configured external application. In industrial environments, these processes often run with elevated privileges, amplifying the impact of successful exploitation.

The vulnerability requires some user interaction (UI:P in the CVSS vector), indicating that the attack may require an administrator to trigger the execution of the external application, though this could occur as part of normal HiVision operations.

Detection Methods for CVE-2022-4987

Indicators of Compromise

• Unexpected executable files appearing in system PATH directories or HiVision application directories
• Unusual process execution originating from the HiVision process or installation path
• Modified timestamps on critical system directories that appear in the search path
• Anomalous network activity or system behavior following execution of external applications through HiVision

Detection Strategies

• Monitor file system changes in directories within the system PATH, particularly focusing on new executable files
• Implement application whitelisting to detect unauthorized binaries being executed
• Configure endpoint detection rules to alert on child processes spawned by HiVision that don't match expected external application paths
• Review Windows Event Logs for process creation events associated with HiVision

Monitoring Recommendations

• Enable detailed process auditing on systems running HiVision to capture parent-child process relationships
• Deploy file integrity monitoring (FIM) on critical directories in the execution path
• Configure SentinelOne Singularity to monitor for suspicious process lineage from HiVision processes
• Regularly audit configured external applications in HiVision and verify their paths are correct and secure

How to Mitigate CVE-2022-4987

Immediate Actions Required

• Upgrade Hirschmann Industrial HiVision to version 08.1.04 or later, which addresses this vulnerability
• Review all configured external applications in HiVision and ensure they use absolute paths rather than relative paths
• Restrict write access to directories in the system PATH to administrators only
• Implement application whitelisting to prevent unauthorized executables from running

Patch Information

Belden, the parent company of Hirschmann, has released security updates addressing this vulnerability. According to the Belden Security Bulletin BSECV-2021-03, users should upgrade to Hirschmann Industrial HiVision version 08.1.04 or later. For additional technical details, refer to the VulnCheck Advisory.

Workarounds

• Configure all external applications in HiVision using fully qualified absolute paths to prevent path resolution ambiguity
• Remove write permissions for non-administrative users on all directories in the system PATH
• Implement strict file system ACLs on the HiVision installation directory and its subdirectories
• Consider network segmentation to limit local access to systems running HiVision in industrial environments

# Example: Restrict PATH directory permissions (Windows)
# Review and secure directories in system PATH
icacls "C:\Windows\System32" /inheritance:r /grant:r Administrators:F /grant:r SYSTEM:F

# Verify HiVision installation directory permissions
icacls "C:\Program Files\Hirschmann\Industrial HiVision" /T /Q