Multiple vulnerabilities in Hikvision Access Control and Intercom Products
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2023-28809 CVE-2023-28810 |
| CWE-ID | CWE-384 CWE-284 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
DS-K1T804AEF Hardware solutions / Security hardware applicances DS-K1T804AF Hardware solutions / Security hardware applicances DS-K1T804AMF Hardware solutions / Security hardware applicances DS-K1T341AM Hardware solutions / Security hardware applicances DS-K1T341AMF Hardware solutions / Security hardware applicances DS-K1T671M Hardware solutions / Security hardware applicances DS-K1T671MF Hardware solutions / Security hardware applicances DS-K1T671TM-3XF Hardware solutions / Security hardware applicances DS-K1T671TMFW Hardware solutions / Security hardware applicances DS-K1T671TMW Hardware solutions / Security hardware applicances DS-K1T343EFWX Hardware solutions / Security hardware applicances DS-K1T343EFX Hardware solutions / Security hardware applicances DS-K1T343EWX Hardware solutions / Security hardware applicances DS-K1T343EX Hardware solutions / Security hardware applicances DS-K1T343MFWX Hardware solutions / Security hardware applicances DS-K1T343MFX Hardware solutions / Security hardware applicances DS-K1T343MWX Hardware solutions / Security hardware applicances DS-K1T343MX Hardware solutions / Security hardware applicances DS-K1T341C Hardware solutions / Security hardware applicances DS-K1T320EFWX Hardware solutions / Security hardware applicances DS-K1T320EFX Hardware solutions / Security hardware applicances DS-K1T320EWX Hardware solutions / Security hardware applicances DS-K1T320EX Hardware solutions / Security hardware applicances DS-K1T320MFWX Hardware solutions / Security hardware applicances DS-K1T320MFX Hardware solutions / Security hardware applicances DS-K1T320MWX Hardware solutions / Security hardware applicances DS-K1T320MX Hardware solutions / Security hardware applicances DS-KH63 Series Hardware solutions / Security hardware applicances DS-KH85 Series Hardware solutions / Security hardware applicances DS-KH62 Series Hardware solutions / Security hardware applicances DS-KH9310-WTE1(B) Hardware solutions / Security hardware applicances DS-KH9510-WTE1(B) Hardware solutions / Security hardware applicances |
| Vendor | Hikvision |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Session Fixation
EUVDB-ID: #VU81990
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-28809
CWE-ID:
CWE-384 - Session Fixation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to the affected device does not update the session ID after a user successfully logs in. A remote attacker can forge the IP and session ID of an authenticated user and gain device operation permissions.
MitigationInstall updates from vendor's website.
Vulnerable software versionsDS-K1T804AEF: 1.4.0 221212
DS-K1T804AF: 1.4.0 221212
DS-K1T804AMF: 1.4.0 221212
DS-K1T341AM: 3.2.30 221223
DS-K1T341AMF: 3.2.30 221223
DS-K1T671M: 3.2.30 221223
DS-K1T671MF: 3.2.30 221223
DS-K1T671TM-3XF: 3.2.30 221223
DS-K1T671TMFW: 3.2.30 221223
DS-K1T671TMW: 3.2.30 221223
DS-K1T343EFWX: 3.14.0 230117
DS-K1T343EFX: 3.14.0 230117
DS-K1T343EWX: 3.14.0 230117
DS-K1T343EX: 3.14.0 230117
DS-K1T343MFWX: 3.14.0 230117
DS-K1T343MFX: 3.14.0 230117
DS-K1T343MWX: 3.14.0 230117
DS-K1T343MX: 3.14.0 230117
DS-K1T341C: 3.3.8 230112
DS-K1T320EFWX: 3.5.0 220706
DS-K1T320EFX: 3.5.0 220706
DS-K1T320EWX: 3.5.0 220706
DS-K1T320EX: 3.5.0 220706
DS-K1T320MFWX: 3.5.0 220706
DS-K1T320MFX: 3.5.0 220706
DS-K1T320MWX: 3.5.0 220706
DS-K1T320MX: 3.5.0 220706
CPE2.3- cpe:2.3:h:hikvision:ds-k1t804aef:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t804aef:1.4.0:221212:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t804af:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t804af:1.4.0:221212:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t804amf:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t804amf:1.4.0:221212:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t341am:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t341am:3.2.30:221223:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t341amf:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t341amf:3.2.30:221223:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t671m:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t671mf:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t671tm-3xf:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t671tmfw:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t671tmw:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t343efwx:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t343efx:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t343ewx:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t343ex:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t343mfwx:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t343mfx:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t343mwx:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t343mx:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t341c:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t320efwx:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t320efx:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t320ewx:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t320ex:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t320mfwx:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t320mfx:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t320mwx:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t320mx:*:*:*:*:*:*:*:
http://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-access-control-intercom/
http://packetstormsecurity.com/files/174506/Hikvision-Access-Control-Session-Hijacking.html
http://www.cisa.gov/news-events/ics-advisories/icsa-23-285-14
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Improper access control
EUVDB-ID: #VU81992
Risk: Low
CVSSv3.1: 3.8 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-28810
CWE-ID:
CWE-284 - Improper Access Control
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. A remote attacker on the local network can send specially crafted data packets to the vulnerable interface and modify device network configuration.
MitigationInstall updates from vendor's website.
Vulnerable software versionsDS-K1T804AEF: 1.4.0 221212
DS-K1T804AF: 1.4.0 221212
DS-K1T804AMF: 1.4.0 221212
DS-K1T341AM: 3.2.30 221223
DS-K1T341AMF: 3.2.30 221223
DS-K1T671M: 3.2.30 221223
DS-K1T671MF: 3.2.30 221223
DS-K1T671TM-3XF: 3.2.30 221223
DS-K1T671TMFW: 3.2.30 221223
DS-K1T671TMW: 3.2.30 221223
DS-K1T343EFWX: 3.14.0 230117
DS-K1T343EFX: 3.14.0 230117
DS-K1T343EWX: 3.14.0 230117
DS-K1T343EX: 3.14.0 230117
DS-K1T343MFWX: 3.14.0 230117
DS-K1T343MFX: 3.14.0 230117
DS-K1T343MWX: 3.14.0 230117
DS-K1T343MX: 3.14.0 230117
DS-K1T341C: 3.3.8 230112
DS-K1T320EFWX: 3.5.0 220706
DS-K1T320EFX: 3.5.0 220706
DS-K1T320EWX: 3.5.0 220706
DS-K1T320EX: 3.5.0 220706
DS-K1T320MFWX: 3.5.0 220706
DS-K1T320MFX: 3.5.0 220706
DS-K1T320MWX: 3.5.0 220706
DS-K1T320MX: 3.5.0 220706
DS-KH63 Series: 2.2.8 230219
DS-KH85 Series: 2.2.8 230219
DS-KH62 Series: 1.4.62 220414
DS-KH9310-WTE1(B): 2.1.76 230204
DS-KH9510-WTE1(B): 2.1.76 230204
CPE2.3- cpe:2.3:h:hikvision:ds-k1t804aef:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t804aef:1.4.0:221212:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t804af:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t804af:1.4.0:221212:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t804amf:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t804amf:1.4.0:221212:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t341am:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t341am:3.2.30:221223:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t341amf:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t341amf:3.2.30:221223:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t671m:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t671mf:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t671tm-3xf:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t671tmfw:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t671tmw:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t343efwx:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t343efx:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t343ewx:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t343ex:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t343mfwx:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t343mfx:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t343mwx:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t343mx:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t341c:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t320efwx:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t320efx:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t320ewx:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t320ex:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t320mfwx:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t320mfx:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t320mwx:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-k1t320mx:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-kh63_series:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-kh85_series:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-kh62_series:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-kh9310-wte1_b:*:*:*:*:*:*:*:
- cpe:2.3:h:hikvision:ds-kh9510-wte1_b:*:*:*:*:*:*:*:
http://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-access-control-intercom/
http://www.cisa.gov/news-events/ics-advisories/icsa-23-285-14
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
