XSS Vulnerability in Hikvision Hybrid SAN/Cluster Storage Products
CVE-2022-28172

6.5MEDIUM

Key Information:

Vendor: Hikvision
Status: Ds-a71024/48/72r,ds-a80624s,ds-a81016s,ds-a72024/72r,ds-a80316s,ds-a82024d; Ds-a71024/48r-cvs,ds-a72024/48r-cvs
Vendor: CVE Published:; 27 June 2022

What is CVE-2022-28172?

The web module in certain Hikvision Hybrid SAN/Cluster Storage products is susceptible to a security vulnerability due to insufficient input validation. This vulnerability allows attackers to exploit the system via an XSS attack by sending specially crafted messages containing malicious commands to the affected device. As a result, unauthorized access and manipulation of data could occur, potentially leading to severe security breaches.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/72R,DS-A80316S,DS-A82024D V2.X

DS-A71024/48R-CVS,DS-A72024/48R-CVS V1.X

References

https://www.hikvision.com/en/support/cybersecurity/securi...

http://packetstormsecurity.com/files/170818/Hikvision-Rem...

CVSS V3.1

Score:

6.5

Severity:

MEDIUM

Confidentiality:

High

Integrity:

None

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Unchanged

Timeline

Vulnerability published
Jun 27, 2022
Vulnerability Reserved
Mar 29, 2022

Credit

Thurein Soe

JSON

Hikvision