CVE-2023-28809: Hikvision Ds-k1t320efwx Firmware

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user successfully logs in. To exploit the vulnerability, attackers have to request the session ID at the same time as a valid user logs in, and gain device operation permissions by forging the IP and session ID of an authenticated user.

Affected products

  • Hikvision Ds-k1t320efwx Firmware: affected versions not specified
  • Hikvision Ds-k1t320efx Firmware: affected versions not specified
  • Hikvision Ds-k1t320ewx Firmware: affected versions not specified
  • Hikvision Ds-k1t320ex Firmware: affected versions not specified
  • Hikvision Ds-k1t320mfwx Firmware: affected versions not specified
  • Hikvision Ds-k1t320mfx Firmware: affected versions not specified
  • Hikvision Ds-k1t320mwx Firmware: affected versions not specified
  • Hikvision Ds-k1t320mx Firmware: affected versions not specified
  • Hikvision Ds-k1t341am Firmware: affected versions not specified
  • Hikvision Ds-k1t341amf Firmware: affected versions not specified
  • Hikvision Ds-k1t341cm Firmware: affected versions not specified
  • Hikvision Ds-k1t343ewx Firmware: affected versions not specified
  • Hikvision Ds-k1t343ex Firmware: affected versions not specified
  • Hikvision Ds-k1t343mwx Firmware: affected versions not specified
  • Hikvision Ds-k1t343mx Firmware: affected versions not specified
  • Hikvision Ds-k1t671 Firmware: affected versions not specified
  • Hikvision Ds-k1t671m Firmware: affected versions not specified
  • Hikvision Ds-k1t671mf Firmware: affected versions not specified
  • Hikvision Ds-k1t671t Firmware: affected versions not specified
  • Hikvision Ds-k1t671tm-3xf Firmware: affected versions not specified
  • Hikvision Ds-k1t671tm Firmware: affected versions not specified
  • Hikvision Ds-k1t671tmf Firmware: affected versions not specified
  • Hikvision Ds-k1t671tmfw Firmware: affected versions not specified
  • Hikvision Ds-k1t671tmw Firmware: affected versions not specified
  • Hikvision Ds-k1t804af Firmware: affected versions not specified
  • and 1 more

Published 2023-06-15. Last modified 2026-06-17.