CVE-2023-28808

Tuesday, April 11, 2023

9.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Summary

Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices.

Affected Software

Vendor	Product	Version Range	Status
hikvision	DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/72R,DS-A80316S,DS-A82024D	`V2.X <= V2.3.8-8`	affected
hikvision	DS-A71024/48R-CVS,DS-A72024/48R-CVS	`V1.X <= V1.1.4`	affected

Weaknesses

CWE-284: CWE-284 Improper Access Control

ADP Enrichment

CVE Program Container

Additional References

https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-cluster-stor/

CISA ADP Vulnrichment

SSVC:
Exploitation: none
- Automatable: yes
- Technical Impact: total

References

https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-cluster-stor/

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.