CVE-2022-28173

State: Published
Severity: 9.1 Critical
Published: Dec 21, 2022
Updated: Apr 16, 2025
Reserved: Mar 29, 2022

Description

The web server of some Hikvision wireless bridge products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices.

Scores

CVSS	Score	Vector	Source
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	hikvision

Weaknesses

CWE-284 Improper Access Control

Affected Products

Product	Versions
DS-3WF0AC-2NThikvision	V1.1.0 to before V1.1.0Affected
DS-3WF01C-2N/Ohikvision	V1.0.4 to before V1.0.4Affected

References

https://www.hikvision.com/en/support/cybersecurity/security-advisory/access-control-vulnerability-in-some-hikvision-wireless-bridge-products/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.