| Advisory ID | Severity | Release Date | Reported By | CVE ID |
| HSVD-2025-0047 | High | January 22, 2026 | Internal disclosure | N/A |
Overview
Hillstone Products Buffer Overflow Vulnerability. The vulnerability is due to the fact that the system does not effectively verify the length of the input data when processing a specific network message. The attacker can construct an over-long or deformed packet to trigger buffer overflow, resulting in cross-boundary writing of the program memory, which may cause device process crash, service rejection, etc.
Affected Products & Fix Versions
| PRODUCT | AFFECTED VERSIONS | FIX VERSION |
|---|---|---|
| Firewall | R9 and all subsequent versions | 5.5R10P13、5.5R11P5、5.5R12 |
| IPS | Full version | IPS5.5.11 |
| BDS | Full version | BDS5.5.11 |
| ADC | AX4.0-AX4.3.1 | AX4.4.4 |
Remediation & Mitigation
- Preferred: Upgrade to the fixed software version listed above for your product as soon as possible.
- Temporary workaround: If an immediate upgrade is not possible, restrict management access by configuring trusted host (admin host) settings and limiting management interface scope to trusted IP ranges only.
Contact & Reporting
For technical support and detailed remediation guidance, contact Hillstone Networks support at +1-800-930-6707.
To report security issues in Hillstone products, email PSIRT@hillstonenet.com. Hillstone follows responsible disclosure principles and applicable regulations when handling product security incidents.
Legal notice — Without written authorization from Hillstone Networks, no organization or individual may modify, excerpt, or disseminate the content of this advisory for commercial purposes.
Recent Comments