CVE-2021-4477
Published: 03 April 2026
Summary
CVE-2021-4477 is a critical-severity Improper Access Control (CWE-284) vulnerability in Belden (inferred from references). Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique External Remote Services (T1133); ranked at the 23.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-4 (Information Flow Enforcement) and SC-7 (Boundary Protection).
Deeper analysis
CVE-2021-4477 is a firewall bypass vulnerability affecting Hirschmann HiLCOS OpenBAT and BAT450 products in IPv6 IPsec deployments. It allows traffic from VPN connections to bypass configured firewall rules, stemming from improper access control as classified under CWE-284. The vulnerability carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating high severity due to its potential for significant confidentiality and integrity impacts.
Remote attackers with network access can exploit this vulnerability without privileges or user interaction by establishing IPv6 IPsec connections using IKEv1 or IKEv2 protocols, while simultaneously leveraging an IPv6 Internet connection. This circumvents firewall policy enforcement, enabling unauthorized access to protected resources and potentially allowing data exfiltration or manipulation.
Mitigation details are outlined in the Belden Security Bulletin at https://assets.belden.com/m/5fd1a50fa50cb252/original/Belden-Security-Bulletin-BSECV-1v0-2019-09.pdf and the Vulncheck advisory at https://www.vulncheck.com/advisories/hirschmann-hilcos-openbat-bat450-ipv6-ipsec-firewall-bypass. Security practitioners should consult these references for patch availability, configuration changes, or workarounds specific to the affected products.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-34774
Vulnerability details
Hirschmann HiLCOS OpenBAT and BAT450 products contain a firewall bypass vulnerability in IPv6 IPsec deployments that allows traffic from VPN connections to bypass configured firewall rules. Attackers can exploit this vulnerability by establishing IPv6 IPsec connections (IKEv1 or IKEv2) while…
more
simultaneously using an IPv6 Internet connection to circumvent firewall policy enforcement.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Firewall bypass in public-facing IPv6 IPsec VPN device directly enables external remote services access (T1133) and exploitation of network-exposed applications (T1190) without authentication.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Monitors and controls communications at system boundaries, directly mitigating firewall bypass by ensuring IPv6 IPsec VPN traffic is subjected to configured rules.
Enforces approved authorizations for information flows within systems, preventing VPN traffic from circumventing firewall policy enforcement.
Authorizes, monitors, and controls remote access methods like IPv6 IPsec VPN connections to ensure compliance with access control policies.