HiSecOS 04.0.01 Privilege Escalation via User Role Modification

Successful exploitation of CVE-2023-53908 allows an attacker to bypass access controls and assume administrative privileges on the HiSecOS Firewall. This grants them the ability to modify firewall rules, access sensitive data, and potentially compromise the entire network behind the firewall. The impact is significant, as an attacker could effectively own the firewall and use it as a launchpad for further attacks. This vulnerability shares similarities with other XML injection flaws where improper parsing allows for unauthorized privilege elevation.

Organizations relying on HiSecOS Firewall version 04.0.01, particularly those with limited security controls or those who have not implemented strict input validation on their NETCONF interfaces, are at significant risk. Shared hosting environments utilizing HiSecOS Firewall are also vulnerable.

• linux / server:

journalctl -u hisecos-firewall -g "mops_data endpoint" | grep -i error

• generic web:

curl -I 'https://<firewall_ip>/mops_data' -v | grep -i 'XML Parsing'

1. 2025-12-17Disclosure

   disclosure

1. Gereserveerd2025-12-16
2. Gepubliceerd2025-12-17
3. Gewijzigd2026-04-07
4. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2023-53908 is to upgrade to a patched version of HiSecOS Firewall. Until an upgrade is possible, consider implementing strict input validation on the /mopsdata endpoint to sanitize XML payloads. Review existing NETCONF configurations for any unusual or suspicious entries. Implement a Web Application Firewall (WAF) with rules to detect and block malicious XML payloads targeting the /mopsdata endpoint. After upgrade, confirm the fix by attempting to modify access roles with crafted XML payloads and verifying that the elevation fails.