Design/Logic Flaw

2023-04-1121:15:00

PRIOn knowledge base

www.prio-n.com

design flaw

logic flaw

hikvision

san

cluster

storage

access control

vulnerability

admin permission

crafted messages

nvd

9.2 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

58.4%

JSON

Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices.

CPENameOperatorVersion
ds-a71024_firmwareeq<= 2.3.8-8
ds-a71024_firmwarele1.1.4
ds-a71048_firmwareeq<= 2.3.8-8
ds-a71048r-cvs_firmwarele1.1.4
ds-a71072r_firmwareeq<= 2.3.8-8
ds-a72024_firmwareeq<= 2.3.8-8
ds-a72072r_firmwareeq<= 2.3.8-8
ds-a80316s_firmwareeq<= 2.3.8-8
ds-a80624s_firmwareeq<= 2.3.8-8
ds-a81016s_firmwareeq<= 2.3.8-8

Name	Operator	Version
ds-a71024_firmware	eq	<= 2.3.8-8
ds-a71024_firmware	le	1.1.4
ds-a71048_firmware	eq	<= 2.3.8-8
ds-a71048r-cvs_firmware	le	1.1.4
ds-a71072r_firmware	eq	<= 2.3.8-8
ds-a72024_firmware	eq	<= 2.3.8-8
ds-a72072r_firmware	eq	<= 2.3.8-8
ds-a80316s_firmware	eq	<= 2.3.8-8
ds-a80624s_firmware	eq	<= 2.3.8-8
ds-a81016s_firmware	eq	<= 2.3.8-8