CVE-2015-10148

CVE-2015-10148 impacts Hirschmann HiLCOS devices, including OpenBAT, WLC, BAT300, and BAT54, which are shipped with identical and unchangeable default SSH and SSL keys. This critical vulnerability (CVSS 8.2 HIGH) allows unauthenticated remote attackers to decrypt or intercept encrypted management communications. Attackers can perform man-in-the-middle attacks, impersonate devices, and expose sensitive information due to the shared cryptographic keys. The attack has low complexity, requires no privileges or user interaction, and primarily impacts confidentiality. Currently, there is no evidence of active exploitation in the wild, and no public exploit code is available, though it has received minimal community discussion.