CVE-2023-28808

Published: Apr 11, 2023Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices.

Affected (12)

Products: Hikvision: Ds A71024 Firmware, Ds A71048 Firmware, Ds A71072r Firmware, Ds A80624s Firmware, Ds A81016s Firmware, Ds A72024 Firmware, Ds A72072r Firmware, Ds A80316s Firmware, Ds A82024d Firmware, Ds A71048r Cvs Firmware

10 products

Ds A71048r Cvs Firmware

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Hikvision Ds A71024 Firmware	Up to 2.3.8-8

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hikvision Ds A71048 Firmware	Up to 2.3.8-8

Running on/with	Platform Versions
Hikvision Ds A71048	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hikvision Ds A71072r Firmware	Up to 2.3.8-8

Running on/with	Platform Versions
Hikvision Ds A71072r	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hikvision Ds A80624s Firmware	Up to 2.3.8-8

Running on/with	Platform Versions
Hikvision Ds A80624s	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hikvision Ds A81016s Firmware	Up to 2.3.8-8

Running on/with	Platform Versions
Hikvision Ds A81016s	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hikvision Ds A72024 Firmware	Up to 2.3.8-8

Running on/with	Platform Versions
Hikvision Ds A72024	All versions

Configuration G

1 vulnerable

Vulnerable Software	Affected Versions
Hikvision Ds A72072r Firmware	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hikvision Ds A80316s Firmware	Up to 2.3.8-8

Running on/with	Platform Versions
Hikvision Ds A80316s	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hikvision Ds A82024d Firmware	Up to 2.3.8-8

Running on/with	Platform Versions
Hikvision Ds A82024d	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hikvision Ds A71024 Firmware	Up to 1.1.4

Running on/with	Platform Versions
Hikvision Ds A71024	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hikvision Ds A71048r Cvs Firmware	Up to 1.1.4

Running on/with	Platform Versions
Hikvision Ds A71048r Cvs	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hikvision Ds A72072r Firmware	Up to 2.3.8-8

Running on/with	Platform Versions
Hikvision Ds A72072r	All versions

Related CWEs

CWE-284

Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

References (2)

https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-cluster-stor/

Source: hsrc@hikvision.com

Vendor Advisory

https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-cluster-stor/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.