CVE-2022-28172
- State
- Published
- Severity
- 6.5 Medium
- Published
- Jun 27, 2022
- Updated
- Sep 17, 2024
- Reserved
- Mar 29, 2022
Description
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to XSS attack by sending messages with malicious commands to the affected device.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N | hikvision |
Weaknesses
- CWE-79 Cross-site Scripting (XSS)
Affected Products
| Product | Versions |
|---|---|
DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/72R,DS-A80316S,DS-A82024Dhikvision |
|
DS-A71024/48R-CVS,DS-A72024/48R-CVShikvision |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.