What is the CVSS score of CVE-2023-28810?

CVE-2023-28810 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 10.4%.

Ds K1T804Af Firmware CVE-2023-28810

MEDIUM

Improper Access Control (CWE-284)

2023-06-15 hsrc@hikvision.com

Authentication Bypass Ds K1T804Af Firmware Ds K1T804Amf Firmware Ds K1T341Am Firmware Ds K1T341Amf Firmware Ds K1T671M Firmware Ds K1T671Mf Firmware Ds K1t671 Firmware Ds K1T343Efwx Firmware Ds K1T343Efx Firmware Ds K1T343Ewx Firmware Ds K1T343Ex Firmware Ds K1T343Mfwx Firmware Ds K1T343Mfx Firmware Ds K1T343Mwx Firmware Ds K1T343Mx Firmware Ds K1t341c Firmware Ds K1T320Efwx Firmware Ds K1T320Efx Firmware Ds K1T320Ewx Firmware Ds K1T320Ex Firmware Ds K1T320Mfwx Firmware Ds K1T320Mfx Firmware Ds K1T320Mwx Firmware Ds K1T320Mx Firmware Ds Kh6320 Wte1 Firmware Ds Kh6350 Wte1 Firmware Ds Kh6351 Te1 Firmware Ds Kh6351 Wte1 Firmware Ds Kh6320 Le1 Firmware Ds Kh63Le1 B Firmware Ds Kh6320 Tde1 Firmware Ds Kh6320 Te1 Firmware Ds Kh6320 Wtde1 Firmware Ds Kh8520 Wte1 Firmware Ds Kh6220 Le1 Firmware Ds Kh9310 Wte1 B Firmware Ds Kh9510 Wte1 B Firmware

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

CVE Published

Jun 15, 2023 - 22:15 nvd

MEDIUM 4.3

DescriptionNVD

Some access control/intercom products have unauthorized modification of device network configuration vulnerabilities. Attackers can modify device network configuration by sending specific data packets to the vulnerable interface within the same local network.

AnalysisAI

Some access control/intercom products have unauthorized modification of device network configuration vulnerabilities. Rated medium severity (CVSS 4.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-284. Some access control/intercom products have unauthorized modification of device network configuration vulnerabilities. Attackers can modify device network configuration by sending specific data packets to the vulnerable interface within the same local network. Affected products include: Hikvision Ds-K1T804Af Firmware, Hikvision Ds-K1T804Amf Firmware, Hikvision Ds-K1T341Am Firmware, Hikvision Ds-K1T341Amf Firmware, Hikvision Ds-K1T671M Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.