1. 

    3. 

    4. 

    


    918博天堂·(中国区)首页
    


            
          
          
              



              
    


    
   
   
    
   
    
       
    
    
        
        
    
            
    
                
            
    
            
            
        
    
    
    
    
    
    
        
        

        
    
    
    
    




       
    
        
    
            
                

    

    
    
        Commercial Display
    
    

    

    
    

    

    

    
    
    
        
    
    

    

    


    
    
    
        
    
            
    
                
            
    
        
    
    
    

    

    

    





    


    Security Vulnerability in Some Hikvision Products
    

    
  
    



    
    
    
    



    
    
    
    

   
    
    
       
    
    


    

    


    
  
    
    
    
      
    Security Vulnerability in Some Hikvision Products
    
    
    
  
    
  

    

    

    
    
        
    
            
    SN No. HSRC-202311-03
    

     
    

    Edit: Hikvision Security Response Center (HSRC)
    

     
    

    Initial Release Date: 2023-11-23
    

     
    

    Summary
    

    Some Hikvision products have been affected by an authentication bypass vulnerability in the Hik-Connect Module, which could allow remote attackers to consume services by sending crafted messages to the affected devices.
    

     
    

    CVE ID
    

    CVE-2023-48121
    

     
    

    Scoring
    

    CVSS v3.1 is adopted in this vulnerability scoring.
    

     
    

    (http://www.first.org/cvss/specification-document)
    

     
    

    Base score: 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N)
    

     
    

    Affected Versions
    

    

    No
    
    		

    Product Name
    
    		

    Affected Versions
    
    		

    1
    
    		

    DS-2CV1xxx
    
    		

    build date before 231108
    
    		

    2
    
    		

    DS-2CV2xxx
    
    		

    build date before 231108
    
    		

    3
    
    		

    DS-2CD1xxx
    
    		

    build date before 230614
    
    		

    4
    
    		

    DS-2CD2xx1
    

    DS-2CD2xx3
    

    DS-2CD2xx6
    

    DS-2CD2xx7
    
    		

    build date before 230630
    
    		

    5
DS-2CD2xx2
    
DS-2CD2xx0    		

    build date before 231110
    
    		

    6
    
    		

    DS-2CD2xxx-W
    
    		

    build date before 230831
    
    		

    7
    
    		

    DS-2CD3xxx
    
    		

    build date before 210429
    
    		

    8
    
    		

    HWI-xxxx
    
    		

    build date before 231108
    
    		

    9
    
    		

    IPC-xxx
    
    		

    build date before 230614
    
    		

    10
    
    		

    DS-2DE4xxx
    
    		

    build date before 230519
    
    		

    11
    
    		

    DS-2DE2Axx
    
    		

    build date before 230612
    
    		

    12
    
    		

    iDS-EXXHUH
    
DS-EXXHGH
    
iDS-EXXHQH
    
DVR-EXXHUH
    
    		

    build date before 230825 
    
    		

    13
    
    		

    iDS-72XXHQH-M(C)
    
iDS-72XXHUH-M(C)
    
iDS-72XXHQH-M(E)
    
iDS-72XXHUH-M(E)
    
iDS-72XXHTH-M(C)
    
HW-HWD-72XXMH-G4
    
HW-HWD-62XXMH-G4
    
HL-DVR-216Q-K2(E）
    
    		

    build date before 230823
    
    		

    14
    
    		

    DS-71XXHGH-M(C)
    
DS-72XXHGH-M(C)
    
DS-71XXHGH-K(S)
    
DS-72XXHGH-K(S)
    
HL-DVR-1XXG-K(S)
    
HL-DVR-2XXG-K(S)
    
HL-DVR-1XXG-M(C)
    
HL-DVR-2XXG-M(C)
    
HW-HWD-51XXH(S)
    
HW-HWD-51XXH-G
    
HW-HWD-51XXMH-G
    
iDS-71xxHQH-M(C)
    
iDS-71xxHQH-M(E)
    
iDS-72xxHQH-M/E(C)
    
iDS-72xxHQH-M/E(E)
    
HL-DVR-2XXQ-M(C)
    
HL-DVR-2XXQ-M(E)
    
HW-HWD-61XXMH-G4
    
HW-HWD-61XXMH-G4(E)
    
iDS-71xxHUH-M(C)
    
iDS-72xxHUH-M/E(C)
    
iDS-71xxHUH-M(E)
    
iDS-72xxHUH-M/E(E)
    
HL-DVR-2XXU-M(C)
    
HL-DVR-2XXU-M(E)
    
HW-HWD-71XXMH-G4
    
HW-HWD-71XXMH-G4(E)
    
    		

    build date before 230913
    
    		

    15
    
    		

    DS-76xxNI-Q1(/xP)(D)
    
DS-76xxNI-Q2(/xP)(D)
    
DS-77xxNI-Q4(/xP)(D)
    
DS-76xxNXI-K1(/xP)(B)
    
NVR-2xx(M)H(-xP)-C(D)
    
NVR-1xx(M)H(-xP)-C(D)
    
HW-HWN-42xx(M)H(-xP)(D)
    
HW-HWN-41xx(M)H(-xP)(D)
    
    		

    build date before 230620
    
    		

    16
    
    		

    DS-71xxNI-Q1(/xP)(/M)(D)
    
DS-76xxNI-Q1(C)
    
DS-76xxNI-Q2(C)
    
DS-76xxNI-K1(C)
    
HL-NVR-1xx(M)H-D(D)
    
HW-HWN-21xx(M)H(-xP)(D)
    
HW-HWN-41xxMH(C)
    
HW-HWN-42xxMH(C)
    
HL-NVR-1xxMH-C(C)
    
HL-NVR-2xxMH-C(C)
    
    		

    build date before 230707
    
    		

    17
    
    		

    DS-76xxNI-K2
    
DS-77xxNI-K4
    
    		

    build date before 230712
    
    		

    18
    
    		

    HL-NVR-EXXMH-D/4P(SSD 1T)
    
HL-NVR-EXXMH-D/4P(SSD 2T)
    
DS-EXXNI-Q1(SSD 1T)
    
DS-EXXNI-Q1(SSD 2T)
    
    		

    build date before 230925
    

     
    
    		

    

     
    

    Precondition
    

    The attacker has network access to the device.
    

     
    

    Attack Step
    

    Send a specially crafted malicious message.
    

     
    

    Obtaining Fixed Version
    

    Users can download the patch on the Hikvision official website.
    

     
    

    Source of Vulnerability Information
    

    The vulnerability was reported to EZVIZ Security Team by Joern (@joerngermany).
    

     
    

    Contact Us
    

    To report any security issues or vulnerabilities in Hikvision products and solutions, please contact Hikvision Security Response Center at hsrc@hrbaojie.com.
    

     
    

    Hikvision would like to thank all security researchers for your attention to our products.
    

     
    

    This Security Notice is released and updated based on Hikvision's current investigation results and is subject to changes. 
    

     
    

    2023-11-23 V1.0 INITIAL
    

    2023-11-29 V1.1 UPDATED: Updated Affected Versions
    

    2023-12-04 V1.2 UPDATED: Updated Affected Versions
    

        
    
    
      

    

    

    

    

    

    

    


    



    
    
        
            
            
    
              
              
              
          
    
        
    
    
    
          
    




  


    

  





              
    
    
    


    
    
    
    
        
    
            
    
                
                
                    
                    
            
    
            
    Contact Us
    
        
    
    
    

    
    

    
    
        
            Hik-Partner Pro close
            
    Hik-Partner Pro
    
                
            
    
                Hik-Partner Pro
            
    
            
    Scan and download the app
    
            
    
                Download
            
    
        
        
    
            
    
                
    Hik-Partner Pro
    
                
    
                    Hik-Partner Pro
                
    
            
    
        
    
    
    

    

    
    
        
    
            
                
            
            
        
         
    
    

    


    
     

    



    




    





    




 

    




 

    






    



    

    



      

    






    






    





    






    

    


              

          
          
  
  
    
      
    
          
    Get a better browsing experience
    
          
    You are using a web browser we don’t support. Please try one of the following options to have a better experience of our web content.
    
          
      
              
    • 
                  
                 
                   
              
              
      • 
              
    • 
                  
                   
                   
              
              
      • 
              
    •  
                  
                    
                   
                  
              
      • 
              
    •  
                  
                    
                    
                  
              
      •