CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2022-28172
Medium (6.1) in hikvision. EPSS 0.8% chance of exploitation in the next 30 days.
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to XSS attack by sending messages with malicious commands to the affected device.
Severity
- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 56% of CVEs (scores of 2026-10-31)
- CWE
- CWE-79
- Published
- Modified
- Record from
- the NVD, synced
Affected
- hikvision:ds-a71024_firmware
- hikvision:ds-a71048_firmware
- hikvision:ds-a71048r-cvs_firmware
- hikvision:ds-a71072r_firmware
- hikvision:ds-a72024_firmware
- hikvision:ds-a72048r-cvs_firmware
- hikvision:ds-a72072r_firmware
- hikvision:ds-a80316s_firmware
- hikvision:ds-a80624s_firmware
- hikvision:ds-a81016s_firmware
- hikvision:ds-a82024d_firmware
References
- http://packetstormsecurity.com/files/170818/Hikvision-Remote-Code-Execution-XSS-SQL-Injection.html
- https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-products/
- http://packetstormsecurity.com/files/170818/Hikvision-Remote-Code-Execution-XSS-SQL-Injection.html
- https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-products/