Is CVE-2021-4477 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-4477 being exploited in the wild.

How severe is CVE-2021-4477?

Critical severity, with a CVSS score of 9.1, published 3 April 2026.

Which products and versions are affected?

Hirschmann HiLCOS BAT450 8.80-REL to 10.12-RU1; Hirschmann HiLCOS OpenBAT 8.80-REL to 10.12-RU1.

Is there a fix for CVE-2021-4477?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2021-4477 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2021-4477?

Check whether you run Hirschmann HiLCOS BAT450 or Hirschmann HiLCOS OpenBAT at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-4477: Hirschmann HiLCOS firewall bypass in IPv6 IPsec deployments

CVE-2021-4477 · Severity: critical · CVSS 9.1 · Published 2026-04-03

Hirschmann industrial wireless access points and routers are affected by a security flaw that allows unauthorized network traffic to bypass the device's firewall. This occurs specifically when using IPv6 VPN connections, potentially allowing an attacker to access protected internal network resources that should be blocked. This could lead to unauthorized data access or the ability to compromise other systems on the corporate or industrial network.

Vendors: Hirschmann.

Quick answers

Is CVE-2021-4477 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-4477 being exploited in the wild.
How severe is CVE-2021-4477?: Critical severity, with a CVSS score of 9.1, published 3 April 2026.
Which products and versions are affected?: Hirschmann HiLCOS BAT450 8.80-REL to 10.12-RU1; Hirschmann HiLCOS OpenBAT 8.80-REL to 10.12-RU1.
Is there a fix for CVE-2021-4477?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2021-4477 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2021-4477?: Check whether you run Hirschmann HiLCOS BAT450 or Hirschmann HiLCOS OpenBAT at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in the firewall policy enforcement of Hirschmann HiLCOS (OpenBAT and BAT450) allows for improper access control (CWE-284) in IPv6 IPsec deployments. The flaw is triggered when an attacker establishes an IPv6 IPsec connection (using either IKEv1 or IKEv2) while simultaneously utilizing an IPv6 internet connection. This specific configuration causes the device to fail to apply configured firewall rules to the VPN traffic, allowing it to bypass security policies. The vulnerability is reachable over the network without authentication. A fix is available in version 10.12-RU2 and later.

Affected products

Hirschmann (Belden) HiLCOS OpenBAT 8.80-REL to 10.12-RU1
Hirschmann (Belden) HiLCOS BAT450 8.80-REL to 10.12-RU1

Timeline

2026-04-03: disclosed
2026-04-03: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.