Vulnerability identifier: #VU81990

Vulnerability risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-28809

CWE-ID: CWE-384

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
DS-K1T804AEF
Hardware solutions / Security hardware applicances
DS-K1T804AF
Hardware solutions / Security hardware applicances
DS-K1T804AMF
Hardware solutions / Security hardware applicances
DS-K1T341AM
Hardware solutions / Security hardware applicances
DS-K1T341AMF
Hardware solutions / Security hardware applicances
DS-K1T671M
Hardware solutions / Security hardware applicances
DS-K1T671MF
Hardware solutions / Security hardware applicances
DS-K1T671TM-3XF
Hardware solutions / Security hardware applicances
DS-K1T671TMFW
Hardware solutions / Security hardware applicances
DS-K1T671TMW
Hardware solutions / Security hardware applicances
DS-K1T343EFWX
Hardware solutions / Security hardware applicances
DS-K1T343EFX
Hardware solutions / Security hardware applicances
DS-K1T343EWX
Hardware solutions / Security hardware applicances
DS-K1T343EX
Hardware solutions / Security hardware applicances
DS-K1T343MFWX
Hardware solutions / Security hardware applicances
DS-K1T343MFX
Hardware solutions / Security hardware applicances
DS-K1T343MWX
Hardware solutions / Security hardware applicances
DS-K1T343MX
Hardware solutions / Security hardware applicances
DS-K1T341C
Hardware solutions / Security hardware applicances
DS-K1T320EFWX
Hardware solutions / Security hardware applicances
DS-K1T320EFX
Hardware solutions / Security hardware applicances
DS-K1T320EWX
Hardware solutions / Security hardware applicances
DS-K1T320EX
Hardware solutions / Security hardware applicances
DS-K1T320MFWX
Hardware solutions / Security hardware applicances
DS-K1T320MFX
Hardware solutions / Security hardware applicances
DS-K1T320MWX
Hardware solutions / Security hardware applicances
DS-K1T320MX
Hardware solutions / Security hardware applicances

Vendor: Hikvision

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the affected device does not update the session ID after a user successfully logs in. A remote attacker can forge the IP and session ID of an authenticated user and gain device operation permissions.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

DS-K1T804AEF: 1.4.0 221212

DS-K1T804AF: 1.4.0 221212

DS-K1T804AMF: 1.4.0 221212

DS-K1T341AM: 3.2.30 221223

DS-K1T341AMF: 3.2.30 221223

DS-K1T671M: 3.2.30 221223

DS-K1T671MF: 3.2.30 221223

DS-K1T671TM-3XF: 3.2.30 221223

DS-K1T671TMFW: 3.2.30 221223

DS-K1T671TMW: 3.2.30 221223

DS-K1T343EFWX: 3.14.0 230117

DS-K1T343EFX: 3.14.0 230117

DS-K1T343EWX: 3.14.0 230117

DS-K1T343EX: 3.14.0 230117

DS-K1T343MFWX: 3.14.0 230117

DS-K1T343MFX: 3.14.0 230117

DS-K1T343MWX: 3.14.0 230117

DS-K1T343MX: 3.14.0 230117

DS-K1T341C: 3.3.8 230112

DS-K1T320EFWX: 3.5.0 220706

DS-K1T320EFX: 3.5.0 220706

DS-K1T320EWX: 3.5.0 220706

DS-K1T320EX: 3.5.0 220706

DS-K1T320MFWX: 3.5.0 220706

DS-K1T320MFX: 3.5.0 220706

DS-K1T320MWX: 3.5.0 220706

DS-K1T320MX: 3.5.0 220706

---

External links
http://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-access-control-intercom/
http://packetstormsecurity.com/files/174506/Hikvision-Access-Control-Session-Hijacking.html
http://www.cisa.gov/news-events/ics-advisories/icsa-23-285-14

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.