918博天堂·(中国区)首页

        Security Vulnerabilities in Hikvision Web Browser Plug-in LocalServiceComponents

        Security Vulnerabilities in Hikvision Web Browser Plug-in LocalServiceComponents

        SN No. HSRC-202311-02

         

        Edit: Hikvision Security Response Center (HSRC)

         

        Initial Release Date: 2023-11-23

         

        Summary

        1. A buffer overflow vulnerability in a web browser plug-in could allow an attacker to exploit the vulnerability by sending crafted messages to computers installed with this plug-in, which could lead to arbitrary code execution or cause process exception of the plug-in. 

        2. An attacker could exploit a vulnerability by sending crafted messages to computers installed with this plug-in to modify plug-in parameters, which could cause affected computers to download malicious files. 

         

        CVE ID

        CVE-2023-28812

        CVE-2023-28813

         

        Scoring

        CVSS v3.1 is adopted in this vulnerability scoring(http://www.first.org/cvss/specification-document)

        CVE-2023-28812

        Base score：9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)

        CVE-2023-28813

        Base score：8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H) 

         

        Affected Versions and Fix

        Product Name

        Affected Versions

        Resolved Version

        LocalServiceComponents

        version 1.0.0.78 and the versions prior to it

        1.0.0.81

         

        Obtaining Fixed Version

        Users can download the patch on the Hikvision official website.(http://www.hrbaojie.com/en/support/tools/hitools/cl31f95c645ddb0235/)

         

        Source of vulnerability information

        This vulnerability is reported to HSRC by Team.ENVY (KITRI BoB 12th).

         

        Contact Us

        To report any security issues or vulnerabilities in Hikvision products and solutions, please contact Hikvision Security Response Center at hsrc@hrbaojie.com.

        Hikvision would like to thank all security researchers for your attention to our products.

        Contact Us
        Hik-Partner Pro close
        Hik-Partner Pro
        Hik-Partner Pro
        Scan and download the app
        Download
        Hik-Partner Pro
        Hik-Partner Pro
        back to top

        Get a better browsing experience

        You are using a web browser we don’t support. Please try one of the following options to have a better experience of our web content.

        • browser-chorme
        • browser-edge
        • browser-safari
        • browser-firefox