CVE-2022-28171: Hikvision Ds-a71024 Firmware

Critical severity, CVSS 9.8. EPSS: 51.6% chance of exploitation in the next 30 days.

The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to execute restricted commands by sending messages with malicious commands to the affected device.

Affected products

• Hikvision Ds-a71024 Firmware: up to and including 2.3.8-6; up to and including 1.1.4
• Hikvision Ds-a71048 Firmware: up to and including 2.3.8-6
• Hikvision Ds-a71048r-Cvs Firmware: up to and including 1.1.4
• Hikvision Ds-a71072r Firmware: up to and including 2.3.8-6
• Hikvision Ds-a72024 Firmware: up to and including 2.3.8-6; up to and including 1.1.4
• Hikvision Ds-a72048r-Cvs Firmware: up to and including 1.1.4
• Hikvision Ds-a72072r Firmware: up to and including 2.3.8-6
• Hikvision Ds-a80316s Firmware: up to and including 2.3.8-6
• Hikvision Ds-a80624s Firmware: up to and including 2.3.8-6
• Hikvision Ds-a81016s Firmware: up to and including 2.3.8-6
• Hikvision Ds-a82024d Firmware: up to and including 2.3.8-6

Published 2022-06-27. Last modified 2026-06-17.