CVE-2023-28809

EPSS 0.64%
Veröffentlicht 15.06.2023 19:15:10
Zuletzt bearbeitet 21.11.2024 07:56:03
Erkennungen
Login

Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user successfully logs in. To exploit the vulnerability, attackers have to request the session ID at the same time as a valid user logs in, and gain device operation permissions by forging the IP and session ID of an authenticated user.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 2 Referenzen 5

NVD 26 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Hikvision ≫ Ds-k1t320efwx Firmware Version -

Hikvision ≫ Ds-k1t320efwx Version -

Hikvision ≫ Ds-k1t320efx Firmware Version -

Hikvision ≫ Ds-k1t320efx Version -

Hikvision ≫ Ds-k1t320ewx Firmware Version -

Hikvision ≫ Ds-k1t320ewx Version -

Hikvision ≫ Ds-k1t320ex Firmware Version -

Hikvision ≫ Ds-k1t320ex Version -

Hikvision ≫ Ds-k1t320mfwx Firmware Version -

Hikvision ≫ Ds-k1t320mfwx Version -

Hikvision ≫ Ds-k1t320mfx Firmware Version -

Hikvision ≫ Ds-k1t320mfx Version -

Hikvision ≫ Ds-k1t320mwx Firmware Version -

Hikvision ≫ Ds-k1t320mwx Version -

Hikvision ≫ Ds-k1t320mx Firmware Version -

Hikvision ≫ Ds-k1t320mx Version -

Hikvision ≫ Ds-k1t341am Firmware Version -

Hikvision ≫ Ds-k1t341am Version -

Hikvision ≫ Ds-k1t341amf Firmware Version -

Hikvision ≫ Ds-k1t341amf Version -

Hikvision ≫ Ds-k1t341cm Firmware Version -

Hikvision ≫ Ds-k1t341cm Version -

Hikvision ≫ Ds-k1t343ewx Firmware Version -

Hikvision ≫ Ds-k1t343ewx Version -

Hikvision ≫ Ds-k1t343ex Firmware Version -

Hikvision ≫ Ds-k1t343ex Version -

Hikvision ≫ Ds-k1t343mwx Firmware Version -

Hikvision ≫ Ds-k1t343mwx Version -

Hikvision ≫ Ds-k1t343mx Firmware Version -

Hikvision ≫ Ds-k1t343mx Version -

Hikvision ≫ Ds-k1t671 Firmware Version -

Hikvision ≫ Ds-k1t671 Version -

Hikvision ≫ Ds-k1t671m Firmware Version -

Hikvision ≫ Ds-k1t671m Version -

Hikvision ≫ Ds-k1t671mf Firmware Version -

Hikvision ≫ Ds-k1t671mf Version -

Hikvision ≫ Ds-k1t671t Firmware Version -

Hikvision ≫ Ds-k1t671t Version -

Hikvision ≫ Ds-k1t671tm Firmware Version -

Hikvision ≫ Ds-k1t671tm Version -

Hikvision ≫ Ds-k1t671tm-3xf Firmware Version -

Hikvision ≫ Ds-k1t671tm-3xf Version -

Hikvision ≫ Ds-k1t671tmf Firmware Version -

Hikvision ≫ Ds-k1t671tmf Version -

Hikvision ≫ Ds-k1t671tmfw Firmware Version -

Hikvision ≫ Ds-k1t671tmfw Version -

Hikvision ≫ Ds-k1t671tmw Firmware Version -

Hikvision ≫ Ds-k1t671tmw Version -

Hikvision ≫ Ds-k1t804af Firmware Version -

Hikvision ≫ Ds-k1t804af Version -

Hikvision ≫ Ds-k1t804amf Firmware Version -

Hikvision ≫ Ds-k1t804amf Version -

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.64%	0.456

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	7.5	1.6	5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
hsrc@hikvision.com	7.5	1.6	5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CWE-384 Session Fixation

Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.

http://packetstormsecurity.com/files/174506/Hikvision-Access-Control-Session-Hijacking.html

https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-access-control-intercom/

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2023-28809

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2023-28809

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2023-28809

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2023-28809