CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2022-28173

CVSS 9.1v3.1pub. 2022-12-19upd. 2024-11-21

The web server of some Hikvision wireless bridge products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

  • Hikvision Ds 3wf01c 2n\/o

    HW
    Hikvision
    all versions

  • Hikvision Ds 3wf01c 2n\/o Firmware

    OS
    Hikvision
    < 1.0.4

  • Hikvision Ds 3wf0ac 2nt

    HW
    Hikvision
    all versions

  • Hikvision Ds 3wf0ac 2nt Firmware

    OS
    Hikvision
    < 1.1.0
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
CWE
References

Related vulnerabilities

CVE-2021-36260CRITICAL9.8⚠ KEVPL ✓same vendor

Command injection w serwerze WWW kamer Hikvision (nieautoryzowany RCE)

CVE-2017-7921CRITICAL9.8⚠ KEVPL ✓same vendor

Hikvision IP Camera — ominięcie uwierzytelnienia (Auth Bypass)

CVE-2023-28812CRITICAL9.1PL ✓same vendor

Buffer overflow w wtyczce przeglądarki Hikvision LocalServiceComponents

CVE-2023-28808CRITICAL9.1PL ✓same vendor

Podatność kontroli dostępu w Hikvision Hybrid SAN/Cluster Storage

CVE-2013-4976CRITICAL9.8PL ✓same vendor

Hikvision DS-2CD7153-E — pominięcie uwierzytelnienia przez hardcoded credentials