Cyber Resilience

CVE-2022-28171

HighPublic PoCRCE

Published: 27 June 2022

Published
27 June 2022
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.8652 99.4th percentile
Risk Priority 67 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-28171 is a high-severity OS Command Injection (CWE-78) vulnerability in Hikvision Ds-A71024 Firmware. Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 0.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

The vulnerability CVE-2022-28171 resides in the web module of certain Hikvision Hybrid SAN/Cluster Storage products. It is caused by insufficient input validation and is tracked under CWE-78 and CWE-77, resulting in a command-injection flaw. The issue received a CVSS 3.1 score of 7.5 with an attack vector of network, low complexity, and no required privileges or user interaction, yielding high confidentiality impact.

An unauthenticated remote attacker can exploit the weakness by sending crafted messages that contain malicious commands to the affected device, thereby executing restricted commands on the system.

Hikvision published an official security advisory addressing the flaw in the impacted Hybrid SAN products. Multiple technical write-ups and exploit artifacts referencing the same vulnerability have also been posted on PacketStorm Security.

The CVE maintains an EPSS score of 0.8652 at both its current and peak values.

EU & UK References

Vulnerability details

The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to execute restricted commands by sending messages with malicious commands to the affected device.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

hikvision
ds-a71024 firmware
≤ 2.3.8-6 · ≤ 1.1.4
hikvision
ds-a71048 firmware
≤ 2.3.8-6
hikvision
ds-a71072r firmware
≤ 2.3.8-6
hikvision
ds-a80624s firmware
≤ 2.3.8-6
hikvision
ds-a81016s firmware
≤ 2.3.8-6
hikvision
ds-a72024 firmware
≤ 2.3.8-6 · ≤ 1.1.4
hikvision
ds-a72072r firmware
≤ 2.3.8-6
hikvision
ds-a80316s firmware
≤ 2.3.8-6
hikvision
ds-a82024d firmware
≤ 2.3.8-6
hikvision
ds-a71048r-cvs firmware
≤ 1.1.4
+1 more product configuration(s) — see NVD for full list

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-78

Platform-independent apps typically execute inside a managed runtime or sandbox that restricts direct OS command execution, reducing the ability to exploit OS command injection.

addresses: CWE-78

Validates inputs to block special elements that would alter OS command execution.

References