CVE-2026-89025

Hirschmann HiOS Switch Platform devices suffer from a denial-of-service vulnerability in the integrated web server caused by missing validation of HTTP(S) content (CWE-755, improper handling of exceptional conditions). A remote, unauthenticated attacker can send a specially crafted HTTP(S) request to a specific endpoint that is processed incorrectly, forcing the device to perform an unintended reboot and causing a temporary denial of service. The flaw carries a CVSS 4.0 base score of 8.7 (high) because it is network-reachable with no privileges or user interaction required, though it affects only availability. It impacts managed industrial Ethernet switches deployed in OT/ICS environments such as factories, energy networks, and transportation systems, where even a temporary switch reboot can disrupt production. No public proof-of-concept exists and the vulnerability is not in the CISA KEV catalog, so exploitation is presumed possible but not observed.

What to do: Upgrade to the fixed firmware for your release train: 07.1.12, 08.7.10, 09.0.13, 09.3.03, 10.3.08, or 10.5.00. Until patched, restrict HTTP(S) management access to trusted management VLANs or VPNs, and disable the web-based management interface entirely if it is not required. Monitor devices for unexpected reboots, which are the telltale symptom of this vulnerability being triggered.