Hikvision Vulnerabilities and Affected Products
Vulnerabilities associated with DS-A71024/48R-CVS,DS-A72024/48R-CVS.
Products
Clear product- DS-2CD Series5 vulnerabilities
- HikCentral Professional5 vulnerabilities
- DS-2DE Series4 vulnerabilities
- DS-3WAP521-SI3 vulnerabilities
- DS-3WAP522-SI3 vulnerabilities
- DS-3WAP621E-SI3 vulnerabilities
- DS-3WAP622E-SI3 vulnerabilities
- DS-3WAP622G-SI3 vulnerabilities
- DS-3WAP623E-SI3 vulnerabilities
- DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/72R,DS-A80316S,DS-A82024D3 vulnerabilities
- DS-A71024/48R-CVS,DS-A72024/48R-CVS3 vulnerabilities
- DS-K1T341C3 vulnerabilities
- HikCentral Master Lite3 vulnerabilities
- Intercom Broadcasting System3 vulnerabilities
- CSMP (Comprehensive Security Management Platform) iSecure Center2 vulnerabilities
- CSMP iSecure Center2 vulnerabilities
- DS-7104HGHI-F12 vulnerabilities
- DS-7204HGHI-F12 vulnerabilities
- DS-7604NI-K1 / 4P(B)2 vulnerabilities
- DS-76xxNI-Mx2 vulnerabilities
- DS-77xxNI-Mx2 vulnerabilities
- DS-K1T320XXX2 vulnerabilities
- DS-K1T341AXX2 vulnerabilities
- DS-K1T343XXX2 vulnerabilities
- DS-K1T671XXX2 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2023-28808CRITICAL | Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices. CWE-284Apr 11, 2023 | CVSS9.1v3.1 | EPSS0.825% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-28172MEDIUM | The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to XSS attack by sending messages with malicious commands to the affected device. CWE-79Jun 27, 2022 | CVSS6.5v3.1 | EPSS0.763% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2022-28171HIGH | Hikvision Hybrid SAN Ds-a71024 Firmware - Multiple Remote Code ExecutionThe web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to execute restricted commands by sending messages with malicious commands to the affected device. | CVSS7.5v3.1 | EPSS49.9% | PoCs3 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |