HIGH✓ PATCH🇵🇱 Wersja polska

CVE-2022-28171

CVSS 7.5v3.1pub. 2022-06-27upd. 2024-11-21

The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to execute restricted commands by sending messages with malicious commands to the affected device.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

  • Hikvision Ds A71024

    HW
    Hikvision
    all versions

  • Hikvision Ds A71024 Firmware

    OS
    Hikvision
    ≤ 1.1.4≤ 2.3.8-6

  • Hikvision Ds A71048

    HW
    Hikvision
    all versions

  • Hikvision Ds A71048 Firmware

    OS
    Hikvision
    ≤ 2.3.8-6

  • Hikvision Ds A71048r Cvs

    HW
    Hikvision
    all versions

  • Hikvision Ds A71048r Cvs Firmware

    OS
    Hikvision
    ≤ 1.1.4

  • Hikvision Ds A71072r

    HW
    Hikvision
    all versions

  • Hikvision Ds A71072r Firmware

    OS
    Hikvision
    ≤ 2.3.8-6

  • Hikvision Ds A72024

    HW
    Hikvision
    all versions

  • Hikvision Ds A72024 Firmware

    OS
    Hikvision
    ≤ 1.1.4≤ 2.3.8-6

  • Hikvision Ds A72048r Cvs

    HW
    Hikvision
    all versions

  • Hikvision Ds A72048r Cvs Firmware

    OS
    Hikvision
    ≤ 1.1.4

  • Hikvision Ds A72072r

    HW
    Hikvision
    all versions

  • Hikvision Ds A72072r Firmware

    OS
    Hikvision
    ≤ 2.3.8-6

  • Hikvision Ds A80316s

    HW
    Hikvision
    all versions

  • Hikvision Ds A80316s Firmware

    OS
    Hikvision
    ≤ 2.3.8-6

  • Hikvision Ds A80624s

    HW
    Hikvision
    all versions

  • Hikvision Ds A80624s Firmware

    OS
    Hikvision
    ≤ 2.3.8-6

  • Hikvision Ds A81016s

    HW
    Hikvision
    all versions

  • Hikvision Ds A81016s Firmware

    OS
    Hikvision
    ≤ 2.3.8-6

  • Hikvision Ds A82024d

    HW
    Hikvision
    all versions

  • Hikvision Ds A82024d Firmware

    OS
    Hikvision
    ≤ 2.3.8-6
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
Command Injection
CWE
References

Related vulnerabilities

CVE-2023-28808CRITICAL9.1PL ✓same product

Podatność kontroli dostępu w Hikvision Hybrid SAN/Cluster Storage

CVE-2022-28172MEDIUM6.5same product

The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability...

CVE-2021-36260CRITICAL9.8⚠ KEVPL ✓same vendor

Command injection w serwerze WWW kamer Hikvision (nieautoryzowany RCE)

CVE-2017-7921CRITICAL9.8⚠ KEVPL ✓same vendor

Hikvision IP Camera — ominięcie uwierzytelnienia (Auth Bypass)

CVE-2023-28812CRITICAL9.1PL ✓same vendor

Buffer overflow w wtyczce przeglądarki Hikvision LocalServiceComponents