CVE-2023-28809

Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user successfully logs in. To exploit the vulnerability, attackers have to request the session ID at the same time as a valid user logs in, and gain device operatio...

CVE-2023-28809

CVE-2023-28809 covers a session fixation vulnerability in Hikvision Access Control and Intercom products where the session ID is not updated after login, enabling an attacker to hijack a session and gain device operation permissions. ICSA-23-285-14 lists affected products (DS-K1T804AXX, DS-K1T341...