CVEvulnerability

CVE-2023-28809

7.5 HIGH Published 2023-06-15 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-06-15
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-284, CWE-384

Description

Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user successfully logs in. To exploit the vulnerability, attackers have to request the session ID at the same time as a valid user logs in, and gain device operation permissions by forging the IP and session ID of an authenticated user.

Affected configurations

• hikvision ds-k1t320efwx firmware • hikvision ds-k1t320efx firmware • hikvision ds-k1t320ewx firmware • hikvision ds-k1t320ex firmware • hikvision ds-k1t320mfwx firmware • hikvision ds-k1t320mfx firmware • hikvision ds-k1t320mwx firmware • hikvision ds-k1t320mx firmware • hikvision ds-k1t341am firmware • hikvision ds-k1t341amf firmware • hikvision ds-k1t341cm firmware • hikvision ds-k1t343ewx firmware • hikvision ds-k1t343ex firmware • hikvision ds-k1t343mwx firmware • hikvision ds-k1t343mx firmware • hikvision ds-k1t671 firmware • hikvision ds-k1t671m firmware • hikvision ds-k1t671mf firmware • hikvision ds-k1t671t firmware • hikvision ds-k1t671tm firmware • hikvision ds-k1t671tm-3xf firmware • hikvision ds-k1t671tmf firmware • hikvision ds-k1t671tmfw firmware • hikvision ds-k1t671tmw firmware • hikvision ds-k1t804af firmware • hikvision ds-k1t804amf firmware

Related

Weakness · CWE (2)

  • CWE-284 Improper Access Control weakness
  • CWE-384 Session Fixation weakness

References