| Advisory ID | Severity | Release Date | Reported By | CVE ID |
| HSVD-2026-0058 | High | October 23, 2026 | External submission | N/A |
Overview
A deserialization vulnerability exists in the device management service of the Hillstone HSM (HSM). An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary commands on the HSM server and gain control of it, then use the platform’s device management channel to push backdoor administrator accounts to all managed security devices (such as NGFWs), achieving complete takeover of those devices.
Affected Products & Fix Versions
| Product | Affected Version | Fixed Version |
|---|---|---|
| HSM | All versions prior to HSM 5.6.15 | HSM 5.7.0 |
Remediation & Mitigation
- Upgrade to HSM 5.7.0 or later, which fixes this vulnerability.
Contact & Reporting
For technical support and detailed remediation guidance, contact Hillstone Networks support at +1-800-930-6707.
To report security issues in Hillstone products, email PSIRT@hillstonenet.com. Hillstone follows responsible disclosure principles and applicable regulations when handling product security incidents.
Legal notice — Without written authorization from Hillstone Networks, no organization or individual may modify, excerpt, or disseminate the content of this advisory for commercial purposes.
Recent Comments