CVE-2022-28172

moderate-risk

Published 2022-06-27

The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to XSS attack by sending messages with malicious commands to the affected device.

Do I need to act?

0.59% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.5/10 Medium

NETWORK / LOW complexity

Affected Products (11)

Ds-A71024 Firmware

Ds-A71048 Firmware

Ds-A71072R Firmware

Ds-A80624S Firmware

Ds-A81016S Firmware

Ds-A72024 Firmware

Ds-A72072R Firmware

Ds-A80316S Firmware

Ds-A82024D Firmware

Ds-A71048R-Cvs Firmware

Ds-A72048R-Cvs Firmware

Affected Vendors

Hikvision

References (4)

Third Party Advisory http://packetstormsecurity.com/files/170818/Hikvision-Remote-Code-Execution-XSS-...

Vendor Advisory https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vu...

Third Party Advisory http://packetstormsecurity.com/files/170818/Hikvision-Remote-Code-Execution-XSS-...

Vendor Advisory https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vu...

/ 100

moderate-risk

Severity 24/34 · High

Exploitability 2/34 · Minimal

Exposure 16/34 · Moderate