CVE-2022-28173CWE-284

The web server of some Hikvision wireless bridge products have an access control vulnerability which can be used to obtain the admin permission

Critical · published December 21, 2022

CVSS v3.1
9.1
EPSS
1%
Percentile
51.1
In the wild
Unconfirmed
What it is

🚨 Just a few crafted messages are all it takes to unlock admin access on vulnerable Hikvision wireless bridges! 🔥 Think of it like a clever locksmith who can trick a receptionist into giving them the master key to the entire building, simply by saying the right phrases. That's how an attacker can exploit this access control flaw to gain control over your devices. If an attacker successfully exploits this vulnerability, they could gain full admin permissions, allowing them to manipulate settings, access sensitive data, or even disable security features. This is absolutely devastating for any organization relying on these devices for their operations!

Put simply

Think of it like a clever locksmith who can trick a receptionist into giving them the master key to the entire building, simply by saying the right phrases. That's how an attacker can exploit this access control flaw to gain control over your devices. This access control vulnerability allows unauthorized users to send specially crafted messages to Hikvision wireless bridge devices, which can grant them administrative privileges without the proper authentication checks being performed.

What to do

If an attacker successfully exploits this vulnerability, they could gain full admin permissions, allowing them to manipulate settings, access sensitive data, or even disable security features. This is absolutely devastating for any organization relying on these devices for their operations! Immediately update your Hikvision wireless bridge products to the latest firmware version provided by the manufacturer. Additionally, ensure that access controls are configured properly, and monitor your network for any unusual activity. 🛡️ You’ve got this! Follow these steps to secure your devices and keep your network safe! 💪😊

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00664 · 51.1th percentile
Weakness
CWE-284 · Improper Access Control
Published
2022-12-21T01:21Z
EPSS history
Timeline
  • 21 DEC 01:21Z
    The web server of some Hikvision wireless bridge products have an access control vulnerability which can be used to obtain the admin permission
    cvelistv5