CVE-2016-15058
High · 8.1CVSS
8.1
EPSS
0.2%
Published
Apr 3, 2026
CISA due date
—
The record
Hirschmann HiLCOS Classic Platform switches Classic L2E, L2P, L3E, L3P versions prior to 09.0.06 and Classic L2B prior to 05.3.07 contain a credential exposure vulnerability where user passwords are synchronized with SNMPv1/v2 community strings and transmitted in plaintext when the feature is enabled. Attackers with local network access can sniff SNMP traffic or extract configuration data to recover plaintext credentials and gain unauthorized administrative access to the switches.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-65309 ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores and transmits user… CWE-257
- CVE-2026-1836 The system stores the username and password from the login form after submitting the… CWE-257
- CVE-2026-22576 A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS… CWE-257
- CVE-2026-22574 A storing passwords in a recoverable format vulnerability in Fortinet FortiSOAR PaaS… CWE-257
- CVE-2025-8095 The OECH1 prefix encoding is intended to obfuscate values across the OpenEdge platform. CWE-257
- CVE-2026-22614 The encryption mechanism used in Eaton's EasySoft project file was insecure and… CWE-257
- CVE-2026-30785 Improperly Controlled Modification of Object Prototype Attributes ('Prototype… CWE-257
- CVE-2026-20128 A vulnerability in the Data Collection Agent (DCA) feature of Cisco Catalyst SD-WAN… CWE-257