Description (CNA)
Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user successfully logs in. To exploit the vulnerability, attackers have to request the session ID at the same time as a valid user logs in, and gain device operation permissions by forging the IP and session ID of an authenticated user.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| hikvision / DS-K1T804AXX | affected V1.4.0_build221212 before V1.4.0_build221212 |
| hikvision / DS-K1T341AXX | affected V3.2.30_build221223 before V3.2.30_build221223 |
| hikvision / DS-K1T671XXX | affected V3.2.30_build221223 before V3.2.30_build221223 |
| hikvision / DS-K1T343XXX | affected V3.14.0_build230117 before V3.14.0_build230117 |
| hikvision / DS-K1T341C | affected V3.3.8_build230112 before V3.3.8_build230112 |
| hikvision / DS-K1T320XXX | affected V3.5.0_build220706 before V3.5.0_build220706 |
CWE
CWE-284
References
- https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-some-hikvision-access-control-intercom/
- http://packetstormsecurity.com/files/174506/Hikvision-Access-Control-Session-Hijacking.html
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.