Back to Database
Status published
Critical
CVE-2023-28808
Some Hikvision Hybrid SAN/Cluster Storage products have an access control...
Vulnerability Description
Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-28808
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Souvik Kandar, Arko Dhar
More from hikvision
View All →CVE-2023-28810
Some access control/intercom products have unauthorized modification of device network...
Medium
4.3
CVE-2023-28809
Some access control products are vulnerable to a session hijacking...
High
7.5
CVE-2022-28173
The web server of some Hikvision wireless bridge products have...
Critical
9.1
CVE-2022-28172
The web module in some Hikvision Hybrid SAN/Cluster Storage products...
Medium
6.5
CVE-2022-28171
The web module in some Hikvision Hybrid SAN/Cluster Storage products...
High
7.5
Affected Vendor
hikvision
View all reports →Affected Software
DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/72R,DS-A80316S,DS-A82024D, DS-A71024/48R-CVS,DS-A72024/48R-CVS
Vulnerable Versions:
V2.X, V1.X
Timeline
Official Publish:
April 11th, 2023
Last Modified:
February 7th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N