Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2023-28809

Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user successfully logs in. To exploit the vulne

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
hikvision

Description

Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user successfully logs in. To exploit the vulnerability, attackers have to request the session ID at the same time as a valid user logs in, and gain device operation permissions by forging the IP and session ID of an authenticated user.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

hikvision DS-K1T804AXX

  • V1.4.0_build221212 to < V1.4.0_build221212affected

hikvision DS-K1T341AXX

  • V3.2.30_build221223 to < V3.2.30_build221223affected

hikvision DS-K1T671XXX

  • V3.2.30_build221223 to < V3.2.30_build221223affected

hikvision DS-K1T343XXX

  • V3.14.0_build230117 to < V3.14.0_build230117affected

hikvision DS-K1T341C

  • V3.3.8_build230112 to < V3.3.8_build230112affected

hikvision DS-K1T320XXX

  • V3.5.0_build220706 to < V3.5.0_build220706affected

References