vulnwire
7.4high

CVE-2023-28811

There is a buffer overflow in the password recovery feature of Hikvision NVR/DVR models.

Published 2 y ago · modified 4 mo ago · JSON

CVSS
7.4
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.4%
percentile 34%
Public exploits
0
none known

There is a buffer overflow in the password recovery feature of Hikvision NVR/DVR models. If exploited, an attacker on the same local area network (LAN) could cause the device to malfunction by sending specially crafted packets to an unpatched device.

Exploit prediction (EPSS)

0.39% probability of exploitation in the next 30 days, higher than 34% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.17.4CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
CNA3.17.4CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
NVD3.16.5CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Hikvision iDS-EXXHUH
  • Hikvision DS-EXXHGH
  • Hikvision iDS-EXXHQH
  • Hikvision DVR-EXXHUH
  • Hikvision DVR-EXXHGH
  • Hikvision DVR-EXXHQH
  • Hikvision iDS-72XXHQH-M(C)
  • Hikvision iDS-72XXHUH-M(C)
  • Hikvision iDS-72XXHQH-M(E)
  • Hikvision iDS-72XXHUH-M(E)
  • Hikvision iDS-72XXHTH-M(C)
  • Hikvision HW-HWD-72XXMH-G4
  • Hikvision HW-HWD-62XXMH-G4
  • Hikvision HL-DVR-216Q-K2(E)
  • Hikvision DS-71XXHGH-M(C)
  • Hikvision DS-72XXHGH-M(C)
  • Hikvision DS-71XXHGH-K(S)
  • Hikvision DS-72XXHGH-K(S)
  • Hikvision HL-DVR-1XXG-K(S)
  • Hikvision HL-DVR-2XXG-K(S)
  • Hikvision HL-DVR-1XXG-M(C)
  • Hikvision HL-DVR-2XXG-M(C)
  • Hikvision HW-HWD-51XXH(S)
  • Hikvision HW-HWD-51XXH-G
  • Hikvision HW-HWD-51XXMH-G
  • Hikvision iDS-71xxHQH-M(C)
  • Hikvision iDS-71xxHQH-M(E)
  • Hikvision iDS-72xxHQH-M/E(C)
  • Hikvision iDS-72xxHQH-M/E(E)
  • Hikvision HL-DVR-2XXQ-M(C)
  • Hikvision HL-DVR-2XXQ-M(E)
  • Hikvision HW-HWD-61XXMH-G4
  • Hikvision HW-HWD-61XXMH-G4(E)
  • Hikvision iDS-71xxHUH-M(C)
  • Hikvision iDS-72xxHUH-M/E(C)
  • Hikvision iDS-71xxHUH-M(E)
  • Hikvision iDS-72xxHUH-M/E(E)
  • Hikvision HL-DVR-2XXU-M(C)
  • Hikvision HL-DVR-2XXU-M(E)
  • Hikvision HW-HWD-71XXMH-G4
  • Hikvision HW-HWD-71XXMH-G4(E)
  • Hikvision NVR-2xxMH-C(D)
  • Hikvision NVR-1xxMH-C(D)
  • Hikvision HW-HWN-42xxMH(D)
  • Hikvision HW-HWN-41xxMH(D)
  • Hikvision DS-71xxNI-Q1(C)
  • Hikvision DS-71xxNI-Q1(D)
  • Hikvision HL-NVR-1xxMH-D(C)
  • Hikvision HL-NVR-1xxMH-D(D)
  • Hikvision HW-HWN-21xxMH(C)

Classification

Weakness
  • CWE-120 Buffer Copy without Checking Size of Input

References

  • hikvision.com /en/support/cybersecurity/security-advisory/buffer-overflow-vulnerability-in-hikvision-nvr · x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.