Session Hijacking Vulnerability in Hikvision Access Control Products

CVE-2023-28809

What is CVE-2023-28809?

Certain Hikvision access control products are exposed to a session hijacking vulnerability that occurs due to the failure to update the session ID upon successful user authentication. This flaw allows attackers to capture a session ID during the login process, enabling them to impersonate legitimate users. By tricking the system with a spoofed IP address and session ID, adversaries can gain unauthorized access, potentially compromising sensitive device functions and overall system security.

References