There is a buffer overflow in the password recovery feature of Hikvision NVR/DVR models. If exploited, an attacker on the same local area network (LAN) could cause the device to malfunction by sending specially crafted packets to an unpatched device.
There is a buffer overflow in the password recovery feature of Hikvision NVR/DVR models. If exploited, an attacker on the same local area network (LAN) could cause the device to malfunction by sending specially crafted packets to an unpatched device.
| Vendor | Product | Versions |
|---|---|---|
| Hikvision | iDS | EXXHUH — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | DS | EXXHGH — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | iDS | EXXHQH — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | DVR | EXXHUH — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | DVR | EXXHGH — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | DVR | EXXHQH — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | iDS | 72XXHQH-M(C) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | iDS | 72XXHUH-M(C) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | iDS | 72XXHQH-M(E) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | iDS | 72XXHUH-M(E) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | iDS | 72XXHTH-M(C) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | HW | HWD-72XXMH-G4 — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | HW | HWD-62XXMH-G4 — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | HL | DVR-216Q-K2(E) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | DS | 71XXHGH-M(C) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | DS | 72XXHGH-M(C) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | DS | 71XXHGH-K(S) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | DS | 72XXHGH-K(S) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | HL | DVR-1XXG-K(S) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | HL | DVR-2XXG-K(S) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | HL | DVR-1XXG-M(C) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | HL | DVR-2XXG-M(C) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | HW | HWD-51XXH(S) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | HW | HWD-51XXH-G — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | HW | HWD-51XXMH-G — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | iDS | 71xxHQH-M(C) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | iDS | 71xxHQH-M(E) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | iDS | 72xxHQH-M/E(C) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | iDS | 72xxHQH-M/E(E) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | HL | DVR-2XXQ-M(C) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | HL | DVR-2XXQ-M(E) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | HW | HWD-61XXMH-G4 — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | HW | HWD-61XXMH-G4(E) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | iDS | 71xxHUH-M(C) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | iDS | 72xxHUH-M/E(C) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | iDS | 71xxHUH-M(E) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | iDS | 72xxHUH-M/E(E) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | HL | DVR-2XXU-M(C) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | HL | DVR-2XXU-M(E) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | HW | HWD-71XXMH-G4 — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | HW | HWD-71XXMH-G4(E) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | NVR | 2xxMH-C(D) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | NVR | 1xxMH-C(D) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | HW | HWN-42xxMH(D) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | HW | HWN-41xxMH(D) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | DS | 71xxNI-Q1(C) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | DS | 71xxNI-Q1(D) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | HL | NVR-1xxMH-D(C) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | HL | NVR-1xxMH-D(D) — Build date before 230821(Version before V4.1.60 are not affected) |
| Hikvision | HW | HWN-21xxMH(C) — Build date before 230821(Version before V4.1.60 are not affected) |
Not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS is the best forward-looking signal — see the EPSS row above.
For the full vendor write-up, exploit chains, and reference implementations, see the references list in section 09.
Ask SARA in chat to draft a starting detection for this CVE in your stack of choice.
No directly-cited follow-up CVEs in the KB record for this advisory. The references list in section 09 carries the vendor cross-references.