Login Request a demo
Critical severity · published Apr 11, 2023
CVE-2023-28808
Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the admin permission
9.8
CVSS
0.8%
EPSS
No
On KEV
Description
Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DF
Ds-a71024 Firmware · Hikvision
through 2.3.8-8; through 1.1.4 · source: NVD
DF
Ds-a71048 Firmware · Hikvision
through 2.3.8-8 · source: NVD
DF
Ds-a71048r-cvs Firmware · Hikvision
through 1.1.4 · source: NVD
DF
Ds-a71072r Firmware · Hikvision
through 2.3.8-8 · source: NVD
DF
Ds-a72024 Firmware · Hikvision
through 2.3.8-8 · source: NVD
DF
Ds-a72072r Firmware · Hikvision
through 2.3.8-8 · source: NVD
DF
Ds-a80316s Firmware · Hikvision
through 2.3.8-8 · source: NVD
DF
Ds-a80624s Firmware · Hikvision
through 2.3.8-8 · source: NVD
DF
Ds-a81016s Firmware · Hikvision
through 2.3.8-8 · source: NVD
DF
Ds-a82024d Firmware · Hikvision
through 2.3.8-8 · source: NVD
Affected product
DF
Ds-a71024 Firmware
Hikvision
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-28808
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-28808
Vendor Advisory
https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-cluster-stor/
More from Ds-a71024 Firmware
9.8
CVE-2022-28171
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability
6.1
CVE-2022-28172
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability