Search criteria
9 vulnerabilities found for ds-a80316s_firmware by hikvision
FKIE_CVE-2023-28808
Vulnerability from fkie_nvd - Published: 2023-04-11 21:15 - Updated: 2024-11-21 07:56
Severity ?
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a71024_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "293E1004-ED96-49D9-A137-3F0FF9D737E6",
"versionEndIncluding": "2.3.8-8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a71024:-:*:*:*:*:*:*:*",
"matchCriteriaId": "87F8B1C7-B988-49CF-89D0-09017B4DCEBA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a71048_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7F4543AF-5F7F-4288-B48D-7BA8090BFC0E",
"versionEndIncluding": "2.3.8-8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a71048:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2B0871C6-9FE4-45DE-B2F6-65AD12D91FE2",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a71072r_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9239541E-45D6-4DDB-9ED5-78BCE8081DD8",
"versionEndIncluding": "2.3.8-8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a71072r:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BB9EDB1F-99FE-49BE-B41F-8F844FC3A974",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a80624s_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A0F8168D-436F-4E27-B43A-360516B25567",
"versionEndIncluding": "2.3.8-8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a80624s:-:*:*:*:*:*:*:*",
"matchCriteriaId": "66E737EC-4796-465E-AD67-A267E81FB790",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a81016s_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "834FDC2D-9BE7-4FD9-BE47-534CC491412F",
"versionEndIncluding": "2.3.8-8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a81016s:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8DE0F6B8-F8E8-474E-BFF4-02687D7C0E55",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a72024_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7E53CBF5-C3B7-432D-AE4D-E737BCCBDCD9",
"versionEndIncluding": "2.3.8-8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a72024:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E10B92A9-17C9-4529-B41A-89E49715BC30",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a72072r_firmware:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0F5B78E7-C39C-4806-9A39-390E0185D427",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a72072r:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4BC39D52-7658-4082-AF6C-1FE5CD65B03B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a80316s_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7B00C9DB-29C6-4998-95DE-7932AAF07F8C",
"versionEndIncluding": "2.3.8-8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a80316s:-:*:*:*:*:*:*:*",
"matchCriteriaId": "78FAC011-76C8-4EAB-A8B7-89E5269CAA66",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a82024d_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "51774330-FFE5-4541-9758-F3E9375FC1BA",
"versionEndIncluding": "2.3.8-8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a82024d:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AA2216B1-E331-400F-A708-AA0E49B7C046",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a71024_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FCCEFC5B-58F0-427D-94E9-7EA73DB01FBF",
"versionEndIncluding": "1.1.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a71024:-:*:*:*:*:*:*:*",
"matchCriteriaId": "87F8B1C7-B988-49CF-89D0-09017B4DCEBA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a71048r-cvs_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2D93B293-5F58-4973-A6E1-09ECFE0E5765",
"versionEndIncluding": "1.1.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a71048r-cvs:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A598604F-924B-4678-B70C-5C961FFB0F17",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a72072r_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5A107658-2606-4FE7-8DF0-32E8C820A281",
"versionEndIncluding": "2.3.8-8",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a72072r:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4BC39D52-7658-4082-AF6C-1FE5CD65B03B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices."
}
],
"id": "CVE-2023-28808",
"lastModified": "2024-11-21T07:56:03.443",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.2,
"source": "hsrc@hikvision.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-04-11T21:15:29.723",
"references": [
{
"source": "hsrc@hikvision.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-cluster-stor/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-cluster-stor/"
}
],
"sourceIdentifier": "hsrc@hikvision.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-284"
}
],
"source": "hsrc@hikvision.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2022-28172
Vulnerability from fkie_nvd - Published: 2022-06-27 18:15 - Updated: 2024-11-21 06:56
Severity ?
6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to XSS attack by sending messages with malicious commands to the affected device.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a71024_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "73F0554E-FAE4-4590-B4F6-9FFDCC8CA5E8",
"versionEndIncluding": "2.3.8-6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a71024:-:*:*:*:*:*:*:*",
"matchCriteriaId": "87F8B1C7-B988-49CF-89D0-09017B4DCEBA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a71048_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D680E8E7-0B51-4E57-B93F-777C845F724F",
"versionEndIncluding": "2.3.8-6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a71048:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2B0871C6-9FE4-45DE-B2F6-65AD12D91FE2",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a71072r_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2A4E818B-8946-487A-AAE6-A90C8BB9AC30",
"versionEndIncluding": "2.3.8-6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a71072r:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BB9EDB1F-99FE-49BE-B41F-8F844FC3A974",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a80624s_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "465EF456-2FD9-4999-B509-04F5C5118C3C",
"versionEndIncluding": "2.3.8-6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a80624s:-:*:*:*:*:*:*:*",
"matchCriteriaId": "66E737EC-4796-465E-AD67-A267E81FB790",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a81016s_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "32214804-3AC3-496B-98CC-7DA59BA70700",
"versionEndIncluding": "2.3.8-6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a81016s:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8DE0F6B8-F8E8-474E-BFF4-02687D7C0E55",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a72024_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "727793B5-2ACF-44FA-A736-64840D592B9D",
"versionEndIncluding": "2.3.8-6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a72024:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E10B92A9-17C9-4529-B41A-89E49715BC30",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a72072r_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "29C01AB7-D978-4B36-A948-A5F1757874B3",
"versionEndIncluding": "2.3.8-6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a72072r:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4BC39D52-7658-4082-AF6C-1FE5CD65B03B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a80316s_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4E770A5A-4922-4529-9CAD-8699BD52D221",
"versionEndIncluding": "2.3.8-6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a80316s:-:*:*:*:*:*:*:*",
"matchCriteriaId": "78FAC011-76C8-4EAB-A8B7-89E5269CAA66",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a82024d_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DA3B5E60-851A-4C68-A8FC-D25574216C96",
"versionEndIncluding": "2.3.8-6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a82024d:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AA2216B1-E331-400F-A708-AA0E49B7C046",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a71024_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FCCEFC5B-58F0-427D-94E9-7EA73DB01FBF",
"versionEndIncluding": "1.1.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a71024:-:*:*:*:*:*:*:*",
"matchCriteriaId": "87F8B1C7-B988-49CF-89D0-09017B4DCEBA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a71048r-cvs_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2D93B293-5F58-4973-A6E1-09ECFE0E5765",
"versionEndIncluding": "1.1.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a71048r-cvs:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A598604F-924B-4678-B70C-5C961FFB0F17",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a72024_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "89B4C8F0-9E69-436B-9895-48524B444539",
"versionEndIncluding": "1.1.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a72024:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E10B92A9-17C9-4529-B41A-89E49715BC30",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a72048r-cvs_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0119D3D1-49BD-4A16-A7ED-C69F22EE48D5",
"versionEndIncluding": "1.1.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a72048r-cvs:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4665C60B-B440-43AD-9047-76BBC1D72D2E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to XSS attack by sending messages with malicious commands to the affected device."
},
{
"lang": "es",
"value": "El m\u00f3dulo web de algunos productos Hikvision Hybrid SAN/Cluster Storage presenta la siguiente vulnerabilidad de seguridad. Debido a una insuficiente comprobaci\u00f3n de entrada, un atacante puede aprovechar la vulnerabilidad para realizar un ataque de tipo XSS mediante el env\u00edo de mensajes con comandos maliciosos al dispositivo afectado"
}
],
"id": "CVE-2022-28172",
"lastModified": "2024-11-21T06:56:53.690",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"source": "hsrc@hikvision.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-06-27T18:15:09.103",
"references": [
{
"source": "hsrc@hikvision.com",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/170818/Hikvision-Remote-Code-Execution-XSS-SQL-Injection.html"
},
{
"source": "hsrc@hikvision.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-products/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/170818/Hikvision-Remote-Code-Execution-XSS-SQL-Injection.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-products/"
}
],
"sourceIdentifier": "hsrc@hikvision.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "hsrc@hikvision.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
FKIE_CVE-2022-28171
Vulnerability from fkie_nvd - Published: 2022-06-27 18:15 - Updated: 2024-11-21 06:56
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to execute restricted commands by sending messages with malicious commands to the affected device.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a71024_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "73F0554E-FAE4-4590-B4F6-9FFDCC8CA5E8",
"versionEndIncluding": "2.3.8-6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a71024:-:*:*:*:*:*:*:*",
"matchCriteriaId": "87F8B1C7-B988-49CF-89D0-09017B4DCEBA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a71048_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D680E8E7-0B51-4E57-B93F-777C845F724F",
"versionEndIncluding": "2.3.8-6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a71048:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2B0871C6-9FE4-45DE-B2F6-65AD12D91FE2",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a71072r_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2A4E818B-8946-487A-AAE6-A90C8BB9AC30",
"versionEndIncluding": "2.3.8-6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a71072r:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BB9EDB1F-99FE-49BE-B41F-8F844FC3A974",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a80624s_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "465EF456-2FD9-4999-B509-04F5C5118C3C",
"versionEndIncluding": "2.3.8-6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a80624s:-:*:*:*:*:*:*:*",
"matchCriteriaId": "66E737EC-4796-465E-AD67-A267E81FB790",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a81016s_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "32214804-3AC3-496B-98CC-7DA59BA70700",
"versionEndIncluding": "2.3.8-6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a81016s:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8DE0F6B8-F8E8-474E-BFF4-02687D7C0E55",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a72024_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "727793B5-2ACF-44FA-A736-64840D592B9D",
"versionEndIncluding": "2.3.8-6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a72024:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E10B92A9-17C9-4529-B41A-89E49715BC30",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a72072r_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "29C01AB7-D978-4B36-A948-A5F1757874B3",
"versionEndIncluding": "2.3.8-6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a72072r:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4BC39D52-7658-4082-AF6C-1FE5CD65B03B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a80316s_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "4E770A5A-4922-4529-9CAD-8699BD52D221",
"versionEndIncluding": "2.3.8-6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a80316s:-:*:*:*:*:*:*:*",
"matchCriteriaId": "78FAC011-76C8-4EAB-A8B7-89E5269CAA66",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a82024d_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DA3B5E60-851A-4C68-A8FC-D25574216C96",
"versionEndIncluding": "2.3.8-6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a82024d:-:*:*:*:*:*:*:*",
"matchCriteriaId": "AA2216B1-E331-400F-A708-AA0E49B7C046",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a71024_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FCCEFC5B-58F0-427D-94E9-7EA73DB01FBF",
"versionEndIncluding": "1.1.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a71024:-:*:*:*:*:*:*:*",
"matchCriteriaId": "87F8B1C7-B988-49CF-89D0-09017B4DCEBA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a71048r-cvs_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "2D93B293-5F58-4973-A6E1-09ECFE0E5765",
"versionEndIncluding": "1.1.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a71048r-cvs:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A598604F-924B-4678-B70C-5C961FFB0F17",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a72024_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "89B4C8F0-9E69-436B-9895-48524B444539",
"versionEndIncluding": "1.1.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a72024:-:*:*:*:*:*:*:*",
"matchCriteriaId": "E10B92A9-17C9-4529-B41A-89E49715BC30",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:hikvision:ds-a72048r-cvs_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0119D3D1-49BD-4A16-A7ED-C69F22EE48D5",
"versionEndIncluding": "1.1.4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:hikvision:ds-a72048r-cvs:-:*:*:*:*:*:*:*",
"matchCriteriaId": "4665C60B-B440-43AD-9047-76BBC1D72D2E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to execute restricted commands by sending messages with malicious commands to the affected device."
},
{
"lang": "es",
"value": "El m\u00f3dulo web de algunos productos Hikvision Hybrid SAN/Cluster Storage presenta la siguiente vulnerabilidad de seguridad. Debido a una insuficiente comprobaci\u00f3n de entrada, el atacante puede explotar la vulnerabilidad para ejecutar comandos restringidos mediante el env\u00edo de mensajes con comandos maliciosos al dispositivo afectado"
}
],
"id": "CVE-2022-28171",
"lastModified": "2024-11-21T06:56:53.540",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "hsrc@hikvision.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-06-27T18:15:09.033",
"references": [
{
"source": "hsrc@hikvision.com",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/170818/Hikvision-Remote-Code-Execution-XSS-SQL-Injection.html"
},
{
"source": "hsrc@hikvision.com",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/173653/Hikvision-Hybrid-SAN-Ds-a71024-SQL-Injection.html"
},
{
"source": "hsrc@hikvision.com",
"tags": [
"Vendor Advisory"
],
"url": "https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-products/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/170818/Hikvision-Remote-Code-Execution-XSS-SQL-Injection.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/173653/Hikvision-Hybrid-SAN-Ds-a71024-SQL-Injection.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-products/"
}
],
"sourceIdentifier": "hsrc@hikvision.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "hsrc@hikvision.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-77"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
CVE-2023-28808 (GCVE-0-2023-28808)
Vulnerability from cvelistv5 – Published: 2023-04-11 00:00 – Updated: 2025-02-07 19:35
VLAI?
Summary
Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices.
Severity ?
9.1 (Critical)
CWE
- CWE-284 - Improper Access Control
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| hikvision | DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/72R,DS-A80316S,DS-A82024D |
Affected:
V2.X , ≤ V2.3.8-8
(custom)
|
|||||||
|
|||||||||
Credits
Souvik Kandar, Arko Dhar
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T13:51:38.489Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-cluster-stor/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-28808",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-07T19:35:09.080119Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-07T19:35:13.163Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/72R,DS-A80316S,DS-A82024D",
"vendor": "hikvision",
"versions": [
{
"lessThanOrEqual": "V2.3.8-8",
"status": "affected",
"version": "V2.X",
"versionType": "custom"
}
]
},
{
"product": "DS-A71024/48R-CVS,DS-A72024/48R-CVS",
"vendor": "hikvision",
"versions": [
{
"lessThanOrEqual": "V1.1.4 ",
"status": "affected",
"version": "V1.X",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Souvik Kandar, Arko Dhar"
}
],
"datePublic": "2023-04-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-04-11T00:00:00.000Z",
"orgId": "da451dce-859b-4e51-8b87-9c8b60d19b32",
"shortName": "hikvision"
},
"references": [
{
"url": "https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-cluster-stor/"
}
],
"solutions": [
{
"lang": "en",
"value": "https://www.hikvision.com/content/dam/hikvision/en/support/notice/security-notification-23-4-10/Fixing-Security-Vulnerability-of-Hybrid-SAN-230407.zip"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.0.9"
}
}
},
"cveMetadata": {
"assignerOrgId": "da451dce-859b-4e51-8b87-9c8b60d19b32",
"assignerShortName": "hikvision",
"cveId": "CVE-2023-28808",
"datePublished": "2023-04-11T00:00:00.000Z",
"dateReserved": "2023-03-23T00:00:00.000Z",
"dateUpdated": "2025-02-07T19:35:13.163Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-28172 (GCVE-0-2022-28172)
Vulnerability from cvelistv5 – Published: 2022-06-27 17:50 – Updated: 2024-09-17 01:10
VLAI?
Summary
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to XSS attack by sending messages with malicious commands to the affected device.
Severity ?
6.5 (Medium)
CWE
- CWE-79 - Cross-site Scripting (XSS)
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| hikvision | DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/72R,DS-A80316S,DS-A82024D |
Affected:
V2.X , ≤ V2.3.8-6
(custom)
|
|||||||
|
|||||||||
Credits
Thurein Soe
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T05:48:37.258Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-products/"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/170818/Hikvision-Remote-Code-Execution-XSS-SQL-Injection.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/72R,DS-A80316S,DS-A82024D",
"vendor": "hikvision",
"versions": [
{
"lessThanOrEqual": "V2.3.8-6",
"status": "affected",
"version": "V2.X",
"versionType": "custom"
}
]
},
{
"product": "DS-A71024/48R-CVS,DS-A72024/48R-CVS",
"vendor": "hikvision",
"versions": [
{
"lessThanOrEqual": "V1.1.4",
"status": "affected",
"version": "V1.X",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Thurein Soe"
}
],
"datePublic": "2022-06-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to XSS attack by sending messages with malicious commands to the affected device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-31T00:00:00",
"orgId": "da451dce-859b-4e51-8b87-9c8b60d19b32",
"shortName": "hikvision"
},
"references": [
{
"url": "https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-products/"
},
{
"url": "http://packetstormsecurity.com/files/170818/Hikvision-Remote-Code-Execution-XSS-SQL-Injection.html"
}
],
"solutions": [
{
"lang": "en",
"value": "https://www.hikvision.com/content/dam/hikvision/en/support/cybersecyrity/security-advisory/Patch-for-Fixing-Security-Vulnerability-of-Hybrid-SAN-\u0026-Cluster-Storage.zip"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.0.9"
}
}
},
"cveMetadata": {
"assignerOrgId": "da451dce-859b-4e51-8b87-9c8b60d19b32",
"assignerShortName": "hikvision",
"cveId": "CVE-2022-28172",
"datePublished": "2022-06-27T17:50:40.922725Z",
"dateReserved": "2022-03-29T00:00:00",
"dateUpdated": "2024-09-17T01:10:46.622Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-28171 (GCVE-0-2022-28171)
Vulnerability from cvelistv5 – Published: 2022-06-27 17:48 – Updated: 2024-09-16 17:03
VLAI?
Summary
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to execute restricted commands by sending messages with malicious commands to the affected device.
Severity ?
7.5 (High)
CWE
- CWE-78 - OS Command Injection
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| hikvision | DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/72R,DS-A80316S,DS-A82024D |
Affected:
V2.X , ≤ V2.3.8-6
(custom)
|
|||||||
|
|||||||||
Credits
Thurein Soe
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T05:48:37.209Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-products/"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/170818/Hikvision-Remote-Code-Execution-XSS-SQL-Injection.html"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/173653/Hikvision-Hybrid-SAN-Ds-a71024-SQL-Injection.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/72R,DS-A80316S,DS-A82024D",
"vendor": "hikvision",
"versions": [
{
"lessThanOrEqual": "V2.3.8-6",
"status": "affected",
"version": "V2.X",
"versionType": "custom"
}
]
},
{
"product": "DS-A71024/48R-CVS,DS-A72024/48R-CVS",
"vendor": "hikvision",
"versions": [
{
"lessThanOrEqual": "V1.1.4",
"status": "affected",
"version": "V1.X",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Thurein Soe"
}
],
"datePublic": "2022-06-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to execute restricted commands by sending messages with malicious commands to the affected device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-07-20T00:00:00",
"orgId": "da451dce-859b-4e51-8b87-9c8b60d19b32",
"shortName": "hikvision"
},
"references": [
{
"url": "https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-products/"
},
{
"url": "http://packetstormsecurity.com/files/170818/Hikvision-Remote-Code-Execution-XSS-SQL-Injection.html"
},
{
"url": "http://packetstormsecurity.com/files/173653/Hikvision-Hybrid-SAN-Ds-a71024-SQL-Injection.html"
}
],
"solutions": [
{
"lang": "en",
"value": "https://www.hikvision.com/content/dam/hikvision/en/support/cybersecyrity/security-advisory/Patch-for-Fixing-Security-Vulnerability-of-Hybrid-SAN-\u0026-Cluster-Storage.zip"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.0.9"
}
}
},
"cveMetadata": {
"assignerOrgId": "da451dce-859b-4e51-8b87-9c8b60d19b32",
"assignerShortName": "hikvision",
"cveId": "CVE-2022-28171",
"datePublished": "2022-06-27T17:48:51.569864Z",
"dateReserved": "2022-03-29T00:00:00",
"dateUpdated": "2024-09-16T17:03:49.464Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-28808 (GCVE-0-2023-28808)
Vulnerability from nvd – Published: 2023-04-11 00:00 – Updated: 2025-02-07 19:35
VLAI?
Summary
Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices.
Severity ?
9.1 (Critical)
CWE
- CWE-284 - Improper Access Control
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| hikvision | DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/72R,DS-A80316S,DS-A82024D |
Affected:
V2.X , ≤ V2.3.8-8
(custom)
|
|||||||
|
|||||||||
Credits
Souvik Kandar, Arko Dhar
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T13:51:38.489Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-cluster-stor/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-28808",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-07T19:35:09.080119Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-07T19:35:13.163Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/72R,DS-A80316S,DS-A82024D",
"vendor": "hikvision",
"versions": [
{
"lessThanOrEqual": "V2.3.8-8",
"status": "affected",
"version": "V2.X",
"versionType": "custom"
}
]
},
{
"product": "DS-A71024/48R-CVS,DS-A72024/48R-CVS",
"vendor": "hikvision",
"versions": [
{
"lessThanOrEqual": "V1.1.4 ",
"status": "affected",
"version": "V1.X",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Souvik Kandar, Arko Dhar"
}
],
"datePublic": "2023-04-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-04-11T00:00:00.000Z",
"orgId": "da451dce-859b-4e51-8b87-9c8b60d19b32",
"shortName": "hikvision"
},
"references": [
{
"url": "https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-cluster-stor/"
}
],
"solutions": [
{
"lang": "en",
"value": "https://www.hikvision.com/content/dam/hikvision/en/support/notice/security-notification-23-4-10/Fixing-Security-Vulnerability-of-Hybrid-SAN-230407.zip"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.0.9"
}
}
},
"cveMetadata": {
"assignerOrgId": "da451dce-859b-4e51-8b87-9c8b60d19b32",
"assignerShortName": "hikvision",
"cveId": "CVE-2023-28808",
"datePublished": "2023-04-11T00:00:00.000Z",
"dateReserved": "2023-03-23T00:00:00.000Z",
"dateUpdated": "2025-02-07T19:35:13.163Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-28172 (GCVE-0-2022-28172)
Vulnerability from nvd – Published: 2022-06-27 17:50 – Updated: 2024-09-17 01:10
VLAI?
Summary
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to XSS attack by sending messages with malicious commands to the affected device.
Severity ?
6.5 (Medium)
CWE
- CWE-79 - Cross-site Scripting (XSS)
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| hikvision | DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/72R,DS-A80316S,DS-A82024D |
Affected:
V2.X , ≤ V2.3.8-6
(custom)
|
|||||||
|
|||||||||
Credits
Thurein Soe
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T05:48:37.258Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-products/"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/170818/Hikvision-Remote-Code-Execution-XSS-SQL-Injection.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/72R,DS-A80316S,DS-A82024D",
"vendor": "hikvision",
"versions": [
{
"lessThanOrEqual": "V2.3.8-6",
"status": "affected",
"version": "V2.X",
"versionType": "custom"
}
]
},
{
"product": "DS-A71024/48R-CVS,DS-A72024/48R-CVS",
"vendor": "hikvision",
"versions": [
{
"lessThanOrEqual": "V1.1.4",
"status": "affected",
"version": "V1.X",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Thurein Soe"
}
],
"datePublic": "2022-06-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to XSS attack by sending messages with malicious commands to the affected device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-01-31T00:00:00",
"orgId": "da451dce-859b-4e51-8b87-9c8b60d19b32",
"shortName": "hikvision"
},
"references": [
{
"url": "https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-products/"
},
{
"url": "http://packetstormsecurity.com/files/170818/Hikvision-Remote-Code-Execution-XSS-SQL-Injection.html"
}
],
"solutions": [
{
"lang": "en",
"value": "https://www.hikvision.com/content/dam/hikvision/en/support/cybersecyrity/security-advisory/Patch-for-Fixing-Security-Vulnerability-of-Hybrid-SAN-\u0026-Cluster-Storage.zip"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.0.9"
}
}
},
"cveMetadata": {
"assignerOrgId": "da451dce-859b-4e51-8b87-9c8b60d19b32",
"assignerShortName": "hikvision",
"cveId": "CVE-2022-28172",
"datePublished": "2022-06-27T17:50:40.922725Z",
"dateReserved": "2022-03-29T00:00:00",
"dateUpdated": "2024-09-17T01:10:46.622Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-28171 (GCVE-0-2022-28171)
Vulnerability from nvd – Published: 2022-06-27 17:48 – Updated: 2024-09-16 17:03
VLAI?
Summary
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to execute restricted commands by sending messages with malicious commands to the affected device.
Severity ?
7.5 (High)
CWE
- CWE-78 - OS Command Injection
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| hikvision | DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/72R,DS-A80316S,DS-A82024D |
Affected:
V2.X , ≤ V2.3.8-6
(custom)
|
|||||||
|
|||||||||
Credits
Thurein Soe
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T05:48:37.209Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-products/"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/170818/Hikvision-Remote-Code-Execution-XSS-SQL-Injection.html"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/173653/Hikvision-Hybrid-SAN-Ds-a71024-SQL-Injection.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/72R,DS-A80316S,DS-A82024D",
"vendor": "hikvision",
"versions": [
{
"lessThanOrEqual": "V2.3.8-6",
"status": "affected",
"version": "V2.X",
"versionType": "custom"
}
]
},
{
"product": "DS-A71024/48R-CVS,DS-A72024/48R-CVS",
"vendor": "hikvision",
"versions": [
{
"lessThanOrEqual": "V1.1.4",
"status": "affected",
"version": "V1.X",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Thurein Soe"
}
],
"datePublic": "2022-06-23T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to execute restricted commands by sending messages with malicious commands to the affected device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 OS Command Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-07-20T00:00:00",
"orgId": "da451dce-859b-4e51-8b87-9c8b60d19b32",
"shortName": "hikvision"
},
"references": [
{
"url": "https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-products/"
},
{
"url": "http://packetstormsecurity.com/files/170818/Hikvision-Remote-Code-Execution-XSS-SQL-Injection.html"
},
{
"url": "http://packetstormsecurity.com/files/173653/Hikvision-Hybrid-SAN-Ds-a71024-SQL-Injection.html"
}
],
"solutions": [
{
"lang": "en",
"value": "https://www.hikvision.com/content/dam/hikvision/en/support/cybersecyrity/security-advisory/Patch-for-Fixing-Security-Vulnerability-of-Hybrid-SAN-\u0026-Cluster-Storage.zip"
}
],
"source": {
"discovery": "EXTERNAL"
},
"x_generator": {
"engine": "Vulnogram 0.0.9"
}
}
},
"cveMetadata": {
"assignerOrgId": "da451dce-859b-4e51-8b87-9c8b60d19b32",
"assignerShortName": "hikvision",
"cveId": "CVE-2022-28171",
"datePublished": "2022-06-27T17:48:51.569864Z",
"dateReserved": "2022-03-29T00:00:00",
"dateUpdated": "2024-09-16T17:03:49.464Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}