CVE-2022-28173
Critical
Description
The web server of some Hikvision wireless bridge products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices.
SeverityCritical
CVSS9.1
Exploit probability—
ProductHikvision Ds-3wf0ac-2nt Firmware
PublishedDec 19, 2022
First seenDec 19, 2022
Weakness typeCWE-284Improper access control
How to fix
Update
- hikvision ds-3wf0ac-2nt_firmware1.1.0 or later
- hikvision ds-3wf01c-2n\/o_firmware1.0.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hikvision ds-3wf0ac-2nt_firmware | v < 1.1.0 | 1.1.0 |
| hikvision ds-3wf01c-2n\/o_firmware | v < 1.0.4 | 1.0.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.