description: Some access control/intercom products have unauthorized modification of device network configuration vulnerabilities. Attackers can modify device network configuration by sending specific data packets to the vulnerable interface within the same local network.
problem types: CWE-284 Improper Access Control
affected:
{
vendor: hikvision
product: DS-K1T804AXX
versions:
version: V1.4.0_build221212, status: affected, lessThan: V1.4.0_build221212, versionType: custom
}
{
vendor: hikvision
product: DS-K1T341AXX
versions:
version: V3.2.30_build221223, status: affected, lessThan: V3.2.30_build221223, versionType: custom
}
{
vendor: hikvision
product: DS-K1T671XXX
versions:
version: V3.2.30_build221223, status: affected, lessThan: V3.2.30_build221223, versionType: custom
}
{
vendor: hikvision
product: DS-K1T343XXX
versions:
version: V3.14.0_build230117, status: affected, lessThan: V3.14.0_build230117, versionType: custom
}
{
vendor: hikvision
product: DS-K1T341C
versions:
version: V3.3.8_build230112, status: affected, lessThan: V3.3.8_build230112, versionType: custom
}
{
vendor: hikvision
product: DS-K1T320XXX
versions:
version: V3.5.0_build220706, status: affected, lessThan: V3.5.0_build220706, versionType: custom
}
{
vendor: hikvision
product: DS-KH63 Series,DS-KH85 Series
versions:
version: V2.2.8_build230219, status: affected, lessThan: V2.2.8_build230219, versionType: custom
}
{
vendor: hikvision
product: DS-KH9310-WTE1(B),DS-KH9510-WTE1(B)
versions:
version: V2.1.76_build230204 , status: affected, lessThan: V2.1.76_build230204 , versionType: custom
}
metrics:
cvssV3_1: [
version: 3.1
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
]
solutions: https://www.hikvision.com/en/support/download/firmware/