CVE-2023-28808

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

VendorProductVersions
hikvisionDS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/72R,DS-A80316S,DS-A82024D>= V2.X, <= V2.3.8-8
hikvisionDS-A71024/48R-CVS,DS-A72024/48R-CVS>= V1.X, <= V1.1.4

References

Timeline

Published
Apr 11, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-288097.5Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user suCVE-2023-28814.9Storing Passwords in a Recoverable Format in GitHub repository pimcore/customer-data-framework prior to 3.3.10.CVE-2023-288104.3Some access control/intercom products have unauthorized modification of device network configuration vulnerabilities. Attackers can modify dCVE-2023-288116.5There is a buffer overflow in the password recovery feature of Hikvision NVR/DVR models. If exploited, an attacker on the same local area neCVE-2023-288129.8There is a buffer overflow vulnerability in a web browser plug-in could allow an attacker to exploit the vulnerability by sending crafted meCVE-2023-288137.5An attacker could exploit a vulnerability by sending crafted messages to computers installed with this plug-in to modify plug-in parameters,CVE-2023-288149.8Some versions of Hikvision's iSecure Center Product have an improper file upload control vulnerability. Due to the improper verification of CVE-2023-288159.8Some versions of Hikvision's iSecure Center Product contain insufficient parameter validation, resulting in a command injection vulnerabilitCVE-2023-288185.3An issue was discovered in Veritas NetBackup IT Analytics 11 before 11.2.0. The application upgrade process included unsigned files that couCVE-2023-288195.4Concrete CMS (previously concrete5) versions 8.5.12 and below, 9.0.0 through 9.0.2 is vulnerable to Stored XSS in uploaded file and folder nCVE-2023-28829.8Generation of Incorrect Security Tokens vulnerability in CBOT Chatbot allows Token Impersonation, Privilege Abuse. This issue affects ChatbCVE-2023-288205.4Concrete CMS (previously concrete5) before 9.1 is vulnerable to stored XSS in RSS Displayer via the href attribute because the link element