CVE-2023-28810: hikvision DS-K1T804AXX, заобикаляне на вход и права

Описание

Оригинално описание

Some access control/intercom products have unauthorized modification of device network configuration vulnerabilities. Attackers can modify device network configuration by sending specific data packets to the vulnerable interface within the same local network.

Засегнати продукти

• hikvision DS-K1T804AXX: V1.4.0_build221212 преди V1.4.0_build221212
• hikvision DS-K1T341AXX: V3.2.30_build221223 преди V3.2.30_build221223
• hikvision DS-K1T671XXX: V3.2.30_build221223 преди V3.2.30_build221223
• hikvision DS-K1T343XXX: V3.14.0_build230117 преди V3.14.0_build230117
• hikvision DS-K1T341C: V3.3.8_build230112 преди V3.3.8_build230112
• hikvision DS-K1T320XXX: V3.5.0_build220706 преди V3.5.0_build220706
• hikvision DS-KH63 Series,DS-KH85 Series: V2.2.8_build230219 преди V2.2.8_build230219
• hikvision DS-KH9310-WTE1(B),DS-KH9510-WTE1(B): V2.1.76_build230204 преди V2.1.76_build230204

Вид слабост

• CWE-284 Неправилен контрол на достъпа

История

Други уязвимости в hikvision DS-K1T804AXX

• 8.8CVE-2025-66176
• 7.5CVE-2023-28809

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2023-28810
• https://nvd.nist.gov/vuln/detail/CVE-2023-28810
• https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-access-control-intercom/