Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user successfully logs in. To exploit the vulnerability, attackers have to request the session ID at the same time as a valid user logs in, and gai
Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user successfully logs in. To exploit the vulnerability, attackers have to request the session ID at the same time as a valid user logs in, and gain device operation permissions by forging the IP and session ID of an authenticated user.
| Vendor | Product | Versions |
|---|---|---|
| hikvision | DS | K1T804AXX — V1.4.0_build221212 |
| hikvision | DS | K1T341AXX — V3.2.30_build221223 |
| hikvision | DS | K1T671XXX — V3.2.30_build221223 |
| hikvision | DS | K1T343XXX — V3.14.0_build230117 |
| hikvision | DS | K1T341C — V3.3.8_build230112 |
| hikvision | DS | K1T320XXX — V3.5.0_build220706 |
Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.
For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.
Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.
No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.