Skip to content
OpenAdvisories
Medium · 6.5 CVE-2022-28172 EUVD-2022-32626GHSA-5h27-7cmr-gg9r

The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient inp…

Published Jun 27, 2022 · Updated Sep 17, 2024 · Assigned by hikvision

Vendor: Hikvision Product: DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/72R,DS-A80316S,DS-A82024D Product: DS-A71024/48R-CVS,DS-A72024/48R-CVS

Description

The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to XSS attack by sending messages with malicious commands to the affected device.

Affected products

VendorProductAffectedFixed
hikvision DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/72R,DS-A80316S,DS-A82024D V2.X – ≤ V2.3.8-6 —
hikvision DS-A71024/48R-CVS,DS-A72024/48R-CVS V1.X – ≤ V1.1.4 —

References