CVE-2023-28808

CRITICAL

Hikvision Hybrid SAN/Cluster Storage - Privilege Escalation

Title source: llm

Description

Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices.

References (1)

Core 1

Core References

Vendor Advisory

https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-cluster-stor/

Scores

CVSS v3 9.1

EPSS 0.0083

EPSS Percentile 52.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-284

Status published

Products (11)

hikvision/ds-a71024_firmware < 2.3.8-8

hikvision/ds-a71048_firmware < 2.3.8-8

hikvision/ds-a71048r-cvs_firmware < 1.1.4

hikvision/ds-a71072r_firmware < 2.3.8-8

hikvision/ds-a72024_firmware < 2.3.8-8

hikvision/ds-a72072r_firmware

hikvision/ds-a72072r_firmware < 2.3.8-8

hikvision/ds-a80316s_firmware < 2.3.8-8

hikvision/ds-a80624s_firmware < 2.3.8-8

hikvision/ds-a81016s_firmware < 2.3.8-8

... and 1 more

Published Apr 11, 2023

Tracked Since Feb 18, 2026