Input validation

2022-06-2718:15:00

PRIOn knowledge base

www.prio-n.com

6.1 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

35.2%

JSON

The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to XSS attack by sending messages with malicious commands to the affected device.

CPENameOperatorVersion
ds-a71024_firmwareeq<= 2.3.8-6
ds-a71024_firmwarele1.1.4
ds-a71048_firmwareeq<= 2.3.8-6
ds-a71048r-cvs_firmwarele1.1.4
ds-a71072r_firmwareeq<= 2.3.8-6
ds-a72024_firmwareeq<= 2.3.8-6
ds-a72024_firmwarele1.1.4
ds-a72048r-cvs_firmwarele1.1.4
ds-a72072r_firmwareeq<= 2.3.8-6
ds-a80316s_firmwareeq<= 2.3.8-6

Name	Operator	Version
ds-a71024_firmware	eq	<= 2.3.8-6
ds-a71024_firmware	le	1.1.4
ds-a71048_firmware	eq	<= 2.3.8-6
ds-a71048r-cvs_firmware	le	1.1.4
ds-a71072r_firmware	eq	<= 2.3.8-6
ds-a72024_firmware	eq	<= 2.3.8-6
ds-a72024_firmware	le	1.1.4
ds-a72048r-cvs_firmware	le	1.1.4
ds-a72072r_firmware	eq	<= 2.3.8-6
ds-a80316s_firmware	eq	<= 2.3.8-6