1. Home
  2. CVE Database
  3. CVE-2023-28811
HIGH · 7.4

CVE-2023-28811

There is a buffer overflow in the password recovery feature of Hikvision NVR/DVR models. If exploited, an attacker on the same local area network (LAN) could cause the device to malfunction by sending...

Vulnerability Description

There is a buffer overflow in the password recovery feature of Hikvision NVR/DVR models. If exploited, an attacker on the same local area network (LAN) could cause the device to malfunction by sending specially crafted packets to an unpatched device.

CVSS Score

7.4

HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH

Affected Products

VendorProductVersions
HikvisionNvr-216Mh-C\(D\) Firmware< 4.1.60
HikvisionNvr-216Mh-C\(D\)-
HikvisionNvr-216Mh-C\/16P\(D\) Firmware< 4.1.60
HikvisionNvr-216Mh-C\/16P\(D\)-
HikvisionNvr-208Mh-C\/8P\(D\) Firmware< 4.1.60
HikvisionNvr-208Mh-C\/8P\(D\)-
HikvisionNvr-104Mh-C\/4P\(D\) Firmware< 4.1.60
HikvisionNvr-104Mh-C\/4P\(D\)-
HikvisionNvr-104Mh-C\(D\) Firmware< 4.1.60
HikvisionNvr-104Mh-C\(D\)-
HikvisionNvr-108Mh-C\(D\) Firmware< 4.1.60
HikvisionNvr-108Mh-C\(D\)-
HikvisionNvr-116Mh-C\(D\) Firmware< 4.1.60
HikvisionNvr-116Mh-C\(D\)-
HikvisionDs-7104Ni-Q1\(C\) Firmware< 4.1.60
HikvisionDs-7104Ni-Q1\(C\)-
HikvisionDs-7104Ni-Q1\(D\) Firmware< 4.1.60
HikvisionDs-7104Ni-Q1\(D\)-
HikvisionDs-7108Ni-Q1\(C\) Firmware< 4.1.60
HikvisionDs-7108Ni-Q1\(C\)-

Related Weaknesses (CWE)

CWE-120

References

FAQ

What is CVE-2023-28811?

CVE-2023-28811 is a vulnerability with a CVSS score of 7.4 (HIGH). There is a buffer overflow in the password recovery feature of Hikvision NVR/DVR models. If exploited, an attacker on the same local area network (LAN) could cause the device to malfunction by sending...

How severe is CVE-2023-28811?

CVE-2023-28811 has been rated HIGH with a CVSS base score of 7.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-28811?

Check the references section above for vendor advisories and patch information. Affected products include: Hikvision Nvr-216Mh-C\(D\) Firmware, Hikvision Nvr-216Mh-C\(D\), Hikvision Nvr-216Mh-C\/16P\(D\) Firmware, Hikvision Nvr-216Mh-C\/16P\(D\), Hikvision Nvr-208Mh-C\/8P\(D\) Firmware.