CVE-2022-28171
CRITICAL 9.8EPSS 51.6%
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to execute restricted commands by sending messages with malicious commands to the affected device.
- Affected
- hikvision · DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/72R,DS-A80316S,DS-A82024D · DS-A71024/48R-CVS,DS-A72024/48R-CVS
- CVSS v3.1 NVD
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v3.1 HIKVISION
- 7.5 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS v2.0 NVD
- 7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P - EPSS
- 51.64% chance of exploitation in the next 30 days, 99th percentile
- Published
- 2022-06-27
- Updated
- 2024-09-16
Proof-of-concept exploits (4)
- http://packetstormsecurity.com/files/173653/Hikvision-Hybrid-SAN-Ds-a71024-SQL-Injection…
- Bibury1337/CVE-2022-28171-POC4★ · 2023-08-09
- NyaMeeEain/CVE-2022-28171-POC4★ · 2023-08-09
- Sapphire2017/CVE-2022-28171-POC4★ · 2023-08-09
ExploitDB entries (1)
Security advisories
- https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabili…
- http://packetstormsecurity.com/files/170818/Hikvision-Remote-Code-Execution-XSS-SQL-Injec…