Headline
CVE-2022-28172: Security Vulnerability in Some Hikvision Hybrid SAN Products
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to XSS attack by sending messages with malicious commands to the affected device.
SN No. HSRC-202206-01
Edit: Hikvision Security Response Center (HSRC)
Initial Release Date: 2022-06-23
Summary
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerabilities:
Due to the insufficient input validation, attacker can exploit the vulnerability to execute restricted commands by sending messages with malicious commands to the affected device.
Due to the insufficient input validation, attacker can exploit the vulnerability to XSS attack by sending messages with malicious commands to the affected device.
CVE ID
CVE-2022-28171
CVE-2022-28172
Scoring
CVSS v3 is adopted in this vulnerability scoring.
(http://www.first.org/cvss/specification-document)
CVE-2022-28171
Base score: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Temporal score: 6.7 (/E:P/RL:O/RC:C)
CVE-2022-28172
Base score: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Temporal score: 5.9 (E:P/RL:O/RC:C)
Affected Versions and Fixes
Product Name
Affected Versions
DS-A71024/48/72R
Versions below V2.3.8-6 (including V2.3.8-6)
DS-A80624S
DS-A81016S
DS-A72024/72R
DS-A80316S
DS-A82024D
DS-A71024/48R-CVS
Versions below V1.1.4 (including V1.1.4)
DS-A72024/48R-CVS
Precondition
The attacker has network access to the device.
Attack Step
Send a specially crafted malicious message.
Obtaining Fixed Versions
Users can download patches/updates on the Hikvision official website (Click here) to mitigate these vulnerabilities.
Source of vulnerability information:
This vulnerability is reported to HSRC by independent security researcher Thurein Soe.
Contact Us
To report any security issues or vulnerabilities in Hikvision products and solutions, please contact Hikvision Security Response Center at [email protected].
Hikvision would like to thank all the security researchers who help identify and mitigate potential vulnerabilities in our products to ensure that our solutions protect people, places, and assets while user data is safeguarded.
Check out the Partner Letter to get more information >>
Related news
Hikvision Hybrid SAN Ds-a71024 firmware suffers from a remote blind SQL injection vulnerability.
Some Hikvision Hybrid SAN products were vulnerable to multiple remote code execution (command injection) vulnerabilities, including reflected cross site scripting, Ruby code injection, classic and blind SQL injection resulting in remote code execution that allows an adversary to execute arbitrary operating system commands and more. However, an adversary must be on the same network to leverage this vulnerability to execute arbitrary commands.