Security Notification - Access Control Vulnerability in Some Hikvision Wireless Bridge Products

SN No. HSRC-202212-01

Edit: Hikvision Security Response Center (HSRC)

Initial Release Date: 2022-12-16

Summary

The web server of some Hikvision wireless bridge products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices.

Hikvision has released a version to fix the vulnerability.

CVE ID

CVE-2022-28173

Scoring

CVSS v3 is adopted in this vulnerability scoring.

(http://www.first.org/cvss/specification-document)

Base score: 9.1(AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)

Temporal score: 8.2 (E:P/RL:O/RC:C)

Affected Versions and Fixes (If the upgrade fails, click online customer service to get help)

Product Name	Affected Versions	Fix Download
DS-3WF0AC-2NT	Versions below V1.1.0	V1.1.0
DS-3WF01C-2N/O	Versions below V1.0.4	V1.0.4

Precondition

The attacker has network access to the device.

Attack Step

Send a specially crafted malicious message.

Obtaining Fixed Versions

Users can download patches/updates on the Hikvision official website.

Source of vulnerability information:

This vulnerability is reported to HSRC by Souvik Kandar, Arko Dhar of the Redinent Innovations team in India.

문의하기

To report any security issues or vulnerabilities in Hikvision products and solutions, please contact Hikvision Security Response Center at hsrc@hikvision.com.

Hikvision would like to thank all security researchers for your attention to our products.

문의하기

Hik-Partner Pro

손끝에서 이루어지는 보안 비즈니스 지원 더 알아보기

Scan and download the app

다운로드

Hik-Partner Pro

Get a better browsing experience

You are using a web browser we don’t support. Please try one of the following options to have a better experience of our web content.

Security Notification - Access Control Vulnerability in Some Hikvision Wireless Bridge Products

Security Notification – Access Control Vulnerability in Some Hikvision Wireless Bridge Products

Get a better browsing experience