CVE-2022-28172: XSS
First published: Mon Jun 27 2022(Updated: )
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to XSS attack by sending messages with malicious commands to the affected device.
Credit: hsrc@hikvision.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Hikvision DS-A71024 | <=2.3.8-6 | |
| Hikvision DS-A71024 Firmware | ||
| Hikvision DS-A71048 Firmware | <=2.3.8-6 | |
| Hikvision DS-A71048 | ||
| Hikvision DS-A71072R Firmware | <=2.3.8-6 | |
| Hikvision DS-A71072R Firmware | ||
| Hikvision DS-A80624S Firmware | <=2.3.8-6 | |
| Hikvision DS-A80624S Firmware | ||
| Hikvision DS-A81016S | <=2.3.8-6 | |
| Hikvision DS-A81016S Firmware | ||
| Hikvision DS-A72024 | <=2.3.8-6 | |
| Hikvision DS-A72024 Firmware | ||
| Hikvision DS-A72072R | <=2.3.8-6 | |
| Hikvision DS-A72072R Firmware | ||
| Hikvision DS-A80316S | <=2.3.8-6 | |
| Hikvision DS-A80316S | ||
| Hikvision DS-A82024D | <=2.3.8-6 | |
| Hikvision DS-A82024D Firmware | ||
| Hikvision DS-A71024 | <=1.1.4 | |
| Hikvision DS-A71048R-CVS | <=1.1.4 | |
| Hikvision DS-A71048R-CVS Firmware | ||
| Hikvision DS-A72024 | <=1.1.4 | |
| Hikvision DS-A72048R-CVS | <=1.1.4 | |
| Hikvision DS-A72048R-CVS Firmware |
Remedy
https://www.hikvision.com/content/dam/hikvision/en/support/cybersecyrity/security-advisory/Patch-for-Fixing-Security-Vulnerability-of-Hybrid-SAN-&-Cluster-Storage.zip
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this security vulnerability?
The vulnerability ID for this security vulnerability is CVE-2022-28172.
What is the severity level of CVE-2022-28172?
The severity level of CVE-2022-28172 is medium with a CVSS score of 6.1.
What is the affected software for CVE-2022-28172?
The affected software for CVE-2022-28172 includes some Hikvision Hybrid SAN/Cluster Storage products with specific firmware versions.
How can an attacker exploit CVE-2022-28172?
An attacker can exploit CVE-2022-28172 by sending messages with malicious commands to the affected device, leading to XSS attacks.
Are there any references for CVE-2022-28172?
Yes, there are references available for CVE-2022-28172. You can find them at the following links: [link1](http://packetstormsecurity.com/files/170818/Hikvision-Remote-Code-Execution-XSS-SQL-Injection.html) and [link2](https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-hybrid-san-products/).
- agent/weakness
- agent/type
- agent/references
- agent/remedy
- agent/severity
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/hikvision
- canonical/hikvision ds-a71024
- version/hikvision ds-a71024/2.3.8-6
- canonical/hikvision ds-a71024 firmware
- canonical/hikvision ds-a71048 firmware
- version/hikvision ds-a71048 firmware/2.3.8-6
- canonical/hikvision ds-a71048
- canonical/hikvision ds-a71072r firmware
- version/hikvision ds-a71072r firmware/2.3.8-6
- canonical/hikvision ds-a80624s firmware
- version/hikvision ds-a80624s firmware/2.3.8-6
- canonical/hikvision ds-a81016s
- version/hikvision ds-a81016s/2.3.8-6
- canonical/hikvision ds-a81016s firmware
- canonical/hikvision ds-a72024
- version/hikvision ds-a72024/2.3.8-6
- canonical/hikvision ds-a72024 firmware
- canonical/hikvision ds-a72072r
- version/hikvision ds-a72072r/2.3.8-6
- canonical/hikvision ds-a72072r firmware
- canonical/hikvision ds-a80316s
- version/hikvision ds-a80316s/2.3.8-6
- canonical/hikvision ds-a82024d
- version/hikvision ds-a82024d/2.3.8-6
- canonical/hikvision ds-a82024d firmware
- version/hikvision ds-a71024/1.1.4
- canonical/hikvision ds-a71048r-cvs
- version/hikvision ds-a71048r-cvs/1.1.4
- canonical/hikvision ds-a71048r-cvs firmware
- version/hikvision ds-a72024/1.1.4
- canonical/hikvision ds-a72048r-cvs
- version/hikvision ds-a72048r-cvs/1.1.4
- canonical/hikvision ds-a72048r-cvs firmware