CVE-2022-28171 in hikvision ds-a71024 firmware
LogPulse has a published detection rule for this CVE: it raises a notable when someone tries to exploit it.
What the vulnerability is
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to execute restricted commands by sending messages with malicious commands to the affected device.
Affected software: hikvision ds-a71024 firmware, hikvision ds-a71048 firmware, hikvision ds-a71072r firmware, hikvision ds-a80624s firmware, hikvision ds-a81016s firmware, hikvision ds-a72024 firmware, hikvision ds-a72072r firmware, hikvision ds-a80316s firmware, hikvision ds-a82024d firmware, hikvision ds-a71048r-cvs firmware
Scores
- CVSS: 9.8 (critical)
- EPSS: 51.64% chance of exploitation in the next 30 days
- CISA KEV: Not listed
- Published: 2022-06-27
What LogPulse has for it
- Detection rule: Yes, published
- Agent check (vulnerable version): No
- Mitigation: No
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.