CVE-2023-28809
First published: Thu Jun 15 2023(Updated: )
Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user successfully logs in. To exploit the vulnerability, attackers have to request the session ID at the same time as a valid user logs in, and gain device operation permissions by forging the IP and session ID of an authenticated user.
Credit: hsrc@hikvision.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Hikvision DS-K1T320EFWX | ||
| Hikvision DS-K1T320EFWX Firmware | ||
| Hikvision DS-K1T320EFX | ||
| Hikvision Ds-k1t320efx Firmware | ||
| Hikvision DS-K1T320EWX Firmware | ||
| Hikvision DS-K1T320EWX Firmware | ||
| Hikvision DS-K1T320EX Firmware | ||
| Hikvision DS-K1T320EX Firmware | ||
| Hikvision DS-K1T320MFWX | ||
| Hikvision DS-K1T320MFWX Firmware | ||
| Hikvision DS-K1T320MFX Firmware | ||
| Hikvision DS-K1T320MFX Firmware | ||
| Hikvision DS-K1T320MFWX Firmware | ||
| Hikvision Ds-k1t320mwx Firmware | ||
| Hikvision DS-K1T320MX Firmware | ||
| Hikvision DS-K1T320MX Firmware | ||
| Hikvision DS-K1T341AM | ||
| Hikvision Ds-k1t341am Firmware | ||
| Hikvision DS-K1T341AMF | ||
| Hikvision DS-K1T341AMF Firmware | ||
| Hikvision DS-K1T341CM | ||
| Hikvision DS-K1T341CM Firmware | ||
| Hikvision DS-K1T343EWX | ||
| Hikvision DS-K1T343EWX Firmware | ||
| Hikvision DS-K1T343EX Firmware | ||
| Hikvision DS-K1T343EX Firmware | ||
| Hikvision DS-K1T343MWX Firmware | ||
| Hikvision DS-K1T343MWX Firmware | ||
| Hikvision DS-K1T343MX | ||
| Hikvision DS-K1T343MX Firmware | ||
| Hikvision DS-K1T671T Firmware | ||
| Hikvision DS-K1T671 | ||
| Hikvision DS-K1T671M Firmware | ||
| Hikvision DS-K1T671M Firmware | ||
| Hikvision DS-K1T671MF Firmware | ||
| Hikvision DS-K1T671MF Firmware | ||
| Hikvision DS-K1T671T | ||
| Hikvision DS-K1T671T Firmware | ||
| Hikvision DS-K1T671TM | ||
| Hikvision DS-K1T671TM-W Firmware | ||
| Hikvision DS-K1T671TM-3XF | ||
| Hikvision DS-K1T671TM-3XF Firmware | ||
| Hikvision DS-K1T671TM-W Firmware | ||
| Hikvision DS-K1T671TMFW | ||
| Hikvision DS-K1T671TM-W Firmware | ||
| Hikvision DS-K1T671TM-W Firmware | ||
| Hikvision DS-K1T671TM-W | ||
| Hikvision DS-K1T671TM-W | ||
| Hikvision DS-K1T804AF | ||
| Hikvision DS-K1T804AF Firmware | ||
| Hikvision DS-K1T804AMF | ||
| Hikvision DS-K1T804AMF Firmware |
Remedy
https://www.hikvision.com/en/support/download/firmware/
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this session hijacking vulnerability?
The vulnerability ID for this session hijacking vulnerability is CVE-2023-28809.
What is the severity of CVE-2023-28809?
The severity of CVE-2023-28809 is high.
Which access control products are affected by CVE-2023-28809?
Hikvision Ds-k1t320efwx Firmware and other related products are affected by CVE-2023-28809.
How does CVE-2023-28809 work?
CVE-2023-28809 allows attackers to perform a session hijacking attack by exploiting the lack of session ID update after a successful login.
Are there any references for CVE-2023-28809?
Yes, you can find more information about CVE-2023-28809 at the following links: [Packet Storm Security](http://packetstormsecurity.com/files/174506/Hikvision-Access-Control-Session-Hijacking.html) and [Hikvision Support](https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-access-control-intercom/).
- agent/type
- agent/references
- agent/weakness
- agent/severity
- agent/remedy
- agent/first-publish-date
- agent/event
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/author
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/hikvision
- canonical/hikvision ds-k1t320efwx
- canonical/hikvision ds-k1t320efwx firmware
- canonical/hikvision ds-k1t320efx
- canonical/hikvision ds-k1t320efx firmware
- canonical/hikvision ds-k1t320ewx firmware
- canonical/hikvision ds-k1t320ex firmware
- canonical/hikvision ds-k1t320mfwx
- canonical/hikvision ds-k1t320mfwx firmware
- canonical/hikvision ds-k1t320mfx firmware
- canonical/hikvision ds-k1t320mwx firmware
- canonical/hikvision ds-k1t320mx firmware
- canonical/hikvision ds-k1t341am
- canonical/hikvision ds-k1t341am firmware
- canonical/hikvision ds-k1t341amf
- canonical/hikvision ds-k1t341amf firmware
- canonical/hikvision ds-k1t341cm
- canonical/hikvision ds-k1t341cm firmware
- canonical/hikvision ds-k1t343ewx
- canonical/hikvision ds-k1t343ewx firmware
- canonical/hikvision ds-k1t343ex firmware
- canonical/hikvision ds-k1t343mwx firmware
- canonical/hikvision ds-k1t343mx
- canonical/hikvision ds-k1t343mx firmware
- canonical/hikvision ds-k1t671t firmware
- canonical/hikvision ds-k1t671
- canonical/hikvision ds-k1t671m firmware
- canonical/hikvision ds-k1t671mf firmware
- canonical/hikvision ds-k1t671t
- canonical/hikvision ds-k1t671tm
- canonical/hikvision ds-k1t671tm-w firmware
- canonical/hikvision ds-k1t671tm-3xf
- canonical/hikvision ds-k1t671tm-3xf firmware
- canonical/hikvision ds-k1t671tmfw
- canonical/hikvision ds-k1t671tm-w
- canonical/hikvision ds-k1t804af
- canonical/hikvision ds-k1t804af firmware
- canonical/hikvision ds-k1t804amf
- canonical/hikvision ds-k1t804amf firmware