Login Request a demo
Critical severity · published Jun 27, 2022
CVE-2022-28171
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability
9.8
CVSS
51.6%
EPSS
No
On KEV
Description
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to execute restricted commands by sending messages with malicious commands to the affected device.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)51.6% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DF
Ds-a71024 Firmware · Hikvision
through 2.3.8-6; through 1.1.4 · source: NVD
DF
Ds-a71048 Firmware · Hikvision
through 2.3.8-6 · source: NVD
DF
Ds-a71048r-cvs Firmware · Hikvision
through 1.1.4 · source: NVD
DF
Ds-a71072r Firmware · Hikvision
through 2.3.8-6 · source: NVD
DF
Ds-a72024 Firmware · Hikvision
through 2.3.8-6; through 1.1.4 · source: NVD
DF
Ds-a72048r-cvs Firmware · Hikvision
through 1.1.4 · source: NVD
DF
Ds-a72072r Firmware · Hikvision
through 2.3.8-6 · source: NVD
DF
Ds-a80316s Firmware · Hikvision
through 2.3.8-6 · source: NVD
DF
Ds-a80624s Firmware · Hikvision
through 2.3.8-6 · source: NVD
DF
Ds-a81016s Firmware · Hikvision
through 2.3.8-6 · source: NVD
DF
Ds-a82024d Firmware · Hikvision
through 2.3.8-6 · source: NVD
Affected product
DF
Ds-a71024 Firmware
Hikvision
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-28171
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-28171
Third Party Advisory
http://packetstormsecurity.com/files/170818/Hikvision-Remote-Code-Execution-XSS-SQL-Injection.html
Exploit
http://packetstormsecurity.com/files/173653/Hikvision-Hybrid-SAN-Ds-a71024-SQL-Injection.html
Vendor Advisory
https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-products/
More from Ds-a71024 Firmware
9.8
CVE-2023-28808
Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the admin permission
6.1
CVE-2022-28172
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability