by Kastro
Paper/Archive/CVE-2022-28173

CVE-2022-28173

hikvision DS-3WF0AC-2NT — The web server of some Hikvision wireless bridge products have an access control vulnerability which can be used to obtain the admin perm…

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 51.8.518 × 2010.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The web server of some Hikvision wireless bridge products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices.

Affected

ProductAffectedFixed inSource
DS-3WF0AC-2NTV1.1.0 – < V1.1.0V1.1.0CNA
DS-3WF01C-2N/OV1.0.4 – < V1.0.4V1.0.4CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
hikvision (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refhikvision.com/en/support/cybersecurity/security-advisory/access-control-vulnerability-in-some-hikvision-wireless-bridge-products