CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2023-28808

CVSS 9.1v3.1pub. 2023-04-11upd. 2024-11-21

Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

  • Hikvision Ds A71024

    HW
    Hikvision
    all versions

  • Hikvision Ds A71024 Firmware

    OS
    Hikvision
    ≤ 2.3.8-8≤ 1.1.4

  • Hikvision Ds A71048

    HW
    Hikvision
    all versions

  • Hikvision Ds A71048 Firmware

    OS
    Hikvision
    ≤ 2.3.8-8

  • Hikvision Ds A71048r Cvs

    HW
    Hikvision
    all versions

  • Hikvision Ds A71048r Cvs Firmware

    OS
    Hikvision
    ≤ 1.1.4

  • Hikvision Ds A71072r

    HW
    Hikvision
    all versions

  • Hikvision Ds A71072r Firmware

    OS
    Hikvision
    ≤ 2.3.8-8

  • Hikvision Ds A72024

    HW
    Hikvision
    all versions

  • Hikvision Ds A72024 Firmware

    OS
    Hikvision
    ≤ 2.3.8-8

  • Hikvision Ds A72072r

    HW
    Hikvision
    all versions

  • Hikvision Ds A72072r Firmware

    OS
    Hikvision
    ≤ 2.3.8-8

  • Hikvision Ds A80316s

    HW
    Hikvision
    all versions

  • Hikvision Ds A80316s Firmware

    OS
    Hikvision
    ≤ 2.3.8-8

  • Hikvision Ds A80624s

    HW
    Hikvision
    all versions

  • Hikvision Ds A80624s Firmware

    OS
    Hikvision
    ≤ 2.3.8-8

  • Hikvision Ds A81016s

    HW
    Hikvision
    all versions

  • Hikvision Ds A81016s Firmware

    OS
    Hikvision
    ≤ 2.3.8-8

  • Hikvision Ds A82024d

    HW
    Hikvision
    all versions

  • Hikvision Ds A82024d Firmware

    OS
    Hikvision
    ≤ 2.3.8-8
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
CWE
References

Related vulnerabilities

CVE-2022-28171HIGH7.5same product

The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability...

CVE-2022-28172MEDIUM6.5same product

The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability...

CVE-2021-36260CRITICAL9.8⚠ KEVPL ✓same vendor

Command injection w serwerze WWW kamer Hikvision (nieautoryzowany RCE)

CVE-2017-7921CRITICAL9.8⚠ KEVPL ✓same vendor

Hikvision IP Camera — ominięcie uwierzytelnienia (Auth Bypass)

CVE-2023-28812CRITICAL9.1PL ✓same vendor

Buffer overflow w wtyczce przeglądarki Hikvision LocalServiceComponents