Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
NA

CVE-2023-28809

Published: 15/06/2023 Updated: 05/09/2023
CVSS v3 Base Score: 7.5 | Impact Score: 5.9 | Exploitability Score: 1.6
VMScore: 0
Subscribe to Hikvision

Vulnerability Summary

Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user successfully logs in. To exploit the vulnerability, attackers have to request the session ID at the same time as a valid user logs in, and gain device operation permissions by forging the IP and session ID of an authenticated user.

Vulnerable Product Search on Vulmon Subscribe to Product

hikvision ds-k1t320efwx_firmware -

hikvision ds-k1t320efx_firmware -

hikvision ds-k1t320ewx_firmware -

hikvision ds-k1t320ex_firmware -

hikvision ds-k1t320mfwx_firmware -

hikvision ds-k1t320mfx_firmware -

hikvision ds-k1t320mwx_firmware -

hikvision ds-k1t320mx_firmware -

hikvision ds-k1t341am_firmware -

hikvision ds-k1t341amf_firmware -

hikvision ds-k1t341cm_firmware -

hikvision ds-k1t343ewx_firmware -

hikvision ds-k1t343ex_firmware -

hikvision ds-k1t343mwx_firmware -

hikvision ds-k1t343mx_firmware -

hikvision ds-k1t671_firmware -

hikvision ds-k1t671m_firmware -

hikvision ds-k1t671mf_firmware -

hikvision ds-k1t671t_firmware -

hikvision ds-k1t671tm_firmware -

hikvision ds-k1t671tm-3xf_firmware -

hikvision ds-k1t671tmf_firmware -

hikvision ds-k1t671tmfw_firmware -

hikvision ds-k1t671tmw_firmware -

hikvision ds-k1t804af_firmware -

hikvision ds-k1t804amf_firmware -

References

CWE-384https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-access-control-intercom/http://packetstormsecurity.com/files/174506/Hikvision-Access-Control-Session-Hijacking.htmlhttps://nvd.nist.gov
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
blind SQL injectionCVE-2006-4304CVE-2023-26603CVE-2024-28327CVE-2023-50363CVE-2024-21905template injectionCVE-2024-3400cross-site request forgery
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook