CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2022-28171
Critical (9.8) in hikvision. EPSS 52% chance of exploitation in the next 30 days.
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to execute restricted commands by sending messages with malicious commands to the affected device.
Severity
- EPSS
- 52% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-77, CWE-78
- Published
- Modified
- Record from
- the NVD, synced
Affected
- hikvision:ds-a71024_firmware
- hikvision:ds-a71048_firmware
- hikvision:ds-a71048r-cvs_firmware
- hikvision:ds-a71072r_firmware
- hikvision:ds-a72024_firmware
- hikvision:ds-a72048r-cvs_firmware
- hikvision:ds-a72072r_firmware
- hikvision:ds-a80316s_firmware
- hikvision:ds-a80624s_firmware
- hikvision:ds-a81016s_firmware
- hikvision:ds-a82024d_firmware
References
- http://packetstormsecurity.com/files/170818/Hikvision-Remote-Code-Execution-XSS-SQL-Injection.html
- http://packetstormsecurity.com/files/173653/Hikvision-Hybrid-SAN-Ds-a71024-SQL-Injection.html
- https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-products/
- http://packetstormsecurity.com/files/170818/Hikvision-Remote-Code-Execution-XSS-SQL-Injection.html
- http://packetstormsecurity.com/files/173653/Hikvision-Hybrid-SAN-Ds-a71024-SQL-Injection.html