high7.4
CVE-2023-28811
There is a buffer overflow in the password recovery feature of Hikvision NVR/DVR models.
Impact
There is a buffer overflow in the password recovery feature of Hikvision NVR/DVR models. If exploited, an attacker on the same local area network (LAN) could cause the device to malfunction by sending specially crafted packets to an unpatched device.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Hikvision | Nvr-216mh-C\(D\) Firmware | before 4.1.60 |
| Hikvision | Nvr-216mh-C\/16p\(D\) Firmware | before 4.1.60 |
| Hikvision | Nvr-208mh-C\/8p\(D\) Firmware | before 4.1.60 |
| Hikvision | Nvr-104mh-C\/4p\(D\) Firmware | before 4.1.60 |
| Hikvision | Nvr-104mh-C\(D\) Firmware | before 4.1.60 |
| Hikvision | Nvr-108mh-C\(D\) Firmware | before 4.1.60 |
| Hikvision | Nvr-116mh-C\(D\) Firmware | before 4.1.60 |
| Hikvision | Ds-7104ni-Q1\(C\) Firmware | before 4.1.60 |
| Hikvision | Ds-7104ni-Q1\(D\) Firmware | before 4.1.60 |
| Hikvision | Ds-7108ni-Q1\(C\) Firmware | before 4.1.60 |
| Hikvision | Ds-7108ni-Q1\(D\) Firmware | before 4.1.60 |
| Hikvision | Nvr-104mh-D\(C\) Firmware | before 4.1.60 |