Vulnerabilities > CVE-2023-28808 - Unspecified vulnerability in Hikvision products

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

hikvision

critical

NVD

Published: 2023-04-11

Updated: 2023-04-24

Summary

Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices.

Vulnerable Configurations

Part	Description	Count
OS	Hikvision Hikvision DS A71024 Firmware - Hikvision DS A71024 Firmware 1.1.4 Hikvision DS A71024 Firmware 2.3.8-6 Hikvision DS A71048 Firmware - Hikvision DS A71048 Firmware 2.3.8-6 Hikvision DS A71072R Firmware - Hikvision DS A71072R Firmware 2.3.8-6 Hikvision DS A80624S Firmware - Hikvision DS A80624S Firmware 2.3.8-6 Hikvision DS A81016S Firmware - Hikvision DS A81016S Firmware 2.3.8-6 Hikvision DS A72024 Firmware - Hikvision DS A72024 Firmware 1.1.4 Hikvision DS A72024 Firmware 2.3.8-6 Hikvision DS A72072R Firmware - Hikvision DS A72072R Firmware 2.3.8-6 Hikvision DS A80316S Firmware - Hikvision DS A80316S Firmware 2.3.8-6 Hikvision DS A82024D Firmware - Hikvision DS A82024D Firmware 2.3.8-6 Hikvision DS A71048R CVS Firmware - Hikvision DS A71048R CVS Firmware 1.1.4	22
Hardware	Hikvision Hikvision DS A71024 - Hikvision DS A71048 - Hikvision DS A71072R - Hikvision DS A80624S - Hikvision DS A81016S - Hikvision DS A72024 - Hikvision DS A72072R - Hikvision DS A80316S - Hikvision DS A82024D - Hikvision DS A71048R CVS -	10

References

https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-cluster-stor/