Hikvision Remote Code Execution / XSS / SQL Injection Vulnerabilities
| Reporter | Title | Published | Views | Family All 27 |
|---|---|---|---|---|
 | Hikvision Hybrid SAN Ds-a71024 Firmware - Multiple Remote Code Execution Exploit | 19 Jul 202300:00 | – | zdt |
 | Exploit for OS Command Injection in Hikvision Ds-A71024_Firmware | 16 Jul 202307:30 | – | githubexploit |
 | CVE-2022-28171 | 23 Jun 202207:00 | – | attackerkb |
| CVE-2022-28172 | 23 Jun 202207:00 | – | attackerkb |
 | CVE-2022-28171 | 27 Jun 202222:34 | – | circl |
| CVE-2022-28172 | 27 Jun 202222:35 | – | circl |
 | Hikvision Hybrid SAN/Cluster Storage Cross-site Scripting Vulnerability | 27 Jun 202200:00 | – | cnnvd |
| Hikvision Hybrid SAN/Cluster Storage command injection vulnerability | 27 Jun 202200:00 | – | cnnvd |
 | Hikvision Hybrid SAN/Cluster Storage Cross-Site Scripting Vulnerability | 30 Jun 202200:00 | – | cnvd |
 | CVE-2022-28171 | 27 Jun 202217:48 | – | cve |
10
Detailed Information
------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Product Name: Hikvision
Vendor Home Page: https://www.hikvision.com
Fixed Version: fixed versions were released by Hikvision
Vulnerability Type: CWE-78,89 and 94
CVE Numbers: CVE-2022-28171-CVE-2022-28172
Author of Advisory: Thurein Soe
------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Vendor Description:
Hikvision is a world-leading surveillance manufacturer and supplier of
video surveillance and Internet of Things (IoT) equipment for civilian and
military purposes.
------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Vulnerability description:
Some Hikvision Hybrid SAN Products were vulnerable to multiple remote code
execution (command injection) vulnerabilities, including Reflected XSS,
Ruby code injection, classic and blind SQL injection resulting in remote
code execution that allows an adversary to execute arbitrary operating
system commands etc. However, an adversary must be on the same network to
leverage this vulnerability to execute arbitrary commands.
------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Vulnerable Versions:
Ds-a71024 Firmware
Ds-a71024 Firmware
Ds-a71048r-cvs Firmware
Ds-a71048 Firmware
Ds-a71072r Firmware
Ds-a71072r Firmware
Ds-a72024 Firmware
Ds-a72024 Firmware
Ds-a72048r-cvs Firmware
Ds-a72072r Firmware
Ds-a80316s Firmware
Ds-a80624s Firmware
Ds-a81016s Firmware
Ds-a82024d Firmware
Ds-a71048r-cvs
Ds-a71024
Ds-a71048
Ds-a71072r
Ds-a80624s
Ds-a82024d
Ds-a80316s
Ds-a81016s
------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Credits:
Thurein Soe
------------------------------------------------------------------------------------------------------------------------------------------------------------------------
References:
https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-products/
https://cve.report/CVE-2022-28171
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
01 Feb 2023 00:00Current
9.7Critical risk
Vulners AI Score9.7
CVSS 27.5
CVSS 3.17.5 - 9.8
EPSS0.51636