Login Request a demo
Medium severity · published Jun 27, 2022
CVE-2022-28172
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability
6.1
CVSS
0.8%
EPSS
No
On KEV
Description
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to XSS attack by sending messages with malicious commands to the affected device.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DF
Ds-a71024 Firmware · Hikvision
through 2.3.8-6; through 1.1.4 · source: NVD
DF
Ds-a71048 Firmware · Hikvision
through 2.3.8-6 · source: NVD
DF
Ds-a71048r-cvs Firmware · Hikvision
through 1.1.4 · source: NVD
DF
Ds-a71072r Firmware · Hikvision
through 2.3.8-6 · source: NVD
DF
Ds-a72024 Firmware · Hikvision
through 2.3.8-6; through 1.1.4 · source: NVD
DF
Ds-a72048r-cvs Firmware · Hikvision
through 1.1.4 · source: NVD
DF
Ds-a72072r Firmware · Hikvision
through 2.3.8-6 · source: NVD
DF
Ds-a80316s Firmware · Hikvision
through 2.3.8-6 · source: NVD
DF
Ds-a80624s Firmware · Hikvision
through 2.3.8-6 · source: NVD
DF
Ds-a81016s Firmware · Hikvision
through 2.3.8-6 · source: NVD
DF
Ds-a82024d Firmware · Hikvision
through 2.3.8-6 · source: NVD
Affected product
DF
Ds-a71024 Firmware
Hikvision
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-28172
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-28172
Third Party Advisory
http://packetstormsecurity.com/files/170818/Hikvision-Remote-Code-Execution-XSS-SQL-Injection.html
Vendor Advisory
https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-products/
More from Ds-a71024 Firmware
9.8
CVE-2023-28808
Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the admin permission
9.8
CVE-2022-28171
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability