CVE-2022-28171
Published: 27 June 2022
Summary
CVE-2022-28171 is a high-severity OS Command Injection (CWE-78) vulnerability in Hikvision Ds-A71024 Firmware. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 0.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The vulnerability CVE-2022-28171 resides in the web module of certain Hikvision Hybrid SAN/Cluster Storage products. It is caused by insufficient input validation and is tracked under CWE-78 and CWE-77, resulting in a command-injection flaw. The issue received a CVSS 3.1 score of 7.5 with an attack vector of network, low complexity, and no required privileges or user interaction, yielding high confidentiality impact.
An unauthenticated remote attacker can exploit the weakness by sending crafted messages that contain malicious commands to the affected device, thereby executing restricted commands on the system.
Hikvision published an official security advisory addressing the flaw in the impacted Hybrid SAN products. Multiple technical write-ups and exploit artifacts referencing the same vulnerability have also been posted on PacketStorm Security.
The CVE maintains an EPSS score of 0.8652 at both its current and peak values.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-32625
Vulnerability details
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to execute restricted commands by sending messages with malicious commands to the affected device.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.