CVE-2022-28171CWE-78

The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability

High · published June 27, 2022

Patch now

High probability of exploitation

CVSS calls it high at 7.5. It sits in the 98.9th percentile for exploit probability.

CVSS v3.1
7.5
EPSS
52%
Percentile
98.9
In the wild
Unconfirmed
What it is

The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to execute restricted commands by sending messages with malicious commands to the affected device.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.51636 · 98.9th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2022-06-27T17:48Z
EPSS history
Timeline
  • 27 JUN 17:48Z
    The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability
    cvelistv5