Vulnerability · Published Jun 15, 2023 · Assigned by hikvision
CVE-2023-28810
Medium 4.3
In plain English
A medium-severity improper access control in DS-K1T320XXX from hikvision. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 10.4% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)10.4%top 4.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
Some access control/intercom products have unauthorized modification of device network configuration vulnerabilities. Attackers can modify device network configuration by sending specific data packets to the vulnerable interface within the same local network.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| hikvision | DS-K1T804AXX | V1.4.0_build221212 – before V1.4.0_build221212 |
| hikvision | DS-K1T341AXX | V3.2.30_build221223 – before V3.2.30_build221223 |
| hikvision | DS-K1T671XXX | V3.2.30_build221223 – before V3.2.30_build221223 |
| hikvision | DS-K1T343XXX | V3.14.0_build230117 – before V3.14.0_build230117 |
| hikvision | DS-K1T341C | V3.3.8_build230112 – before V3.3.8_build230112 |
| hikvision | DS-K1T320XXX | V3.5.0_build220706 – before V3.5.0_build220706 |
| hikvision | DS-KH63 Series,DS-KH85 Series | V2.2.8_build230219 – before V2.2.8_build230219 |
| hikvision | DS-KH9310-WTE1(B),DS-KH9510-WTE1(B) | V2.1.76_build230204 – before V2.1.76_build230204 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N