CVE-2022-28171: Hikvision DS-A71024 Firmware RCE Flaw

CVE-2022-28171 Overview

A command injection vulnerability exists in the web module of multiple Hikvision Hybrid SAN/Cluster Storage products. Due to insufficient input validation, remote attackers can exploit this vulnerability to execute restricted commands by sending specially crafted messages with malicious commands to the affected device. This vulnerability allows unauthenticated attackers to gain complete control over vulnerable storage systems via network-based attacks.

Critical Impact

Remote attackers can execute arbitrary commands on vulnerable Hikvision storage devices without authentication, potentially leading to complete system compromise, data theft, ransomware deployment, or lateral movement within enterprise networks.

Affected Products

• Hikvision DS-A71024 Firmware
• Hikvision DS-A71048 Firmware
• Hikvision DS-A71072R Firmware
• Hikvision DS-A80624S Firmware
• Hikvision DS-A81016S Firmware
• Hikvision DS-A72024 Firmware
• Hikvision DS-A72072R Firmware
• Hikvision DS-A80316S Firmware
• Hikvision DS-A82024D Firmware
• Hikvision DS-A71048R-CVS Firmware
• Hikvision DS-A72048R-CVS Firmware

Discovery Timeline

• June 27, 2022 - CVE-2022-28171 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2022-28171

Vulnerability Analysis

The vulnerability resides in the web module of Hikvision Hybrid SAN/Cluster Storage products, where user-supplied input is not properly sanitized before being passed to system command execution functions. The CWE classifications (CWE-78: OS Command Injection and CWE-77: Command Injection) indicate that attackers can inject arbitrary operating system commands through the web interface.

The attack requires no authentication and can be executed remotely over the network with no user interaction required. Successful exploitation grants the attacker complete control over the storage device, compromising the confidentiality, integrity, and availability of both the device and any data stored on it.

Root Cause

The root cause of this vulnerability is insufficient input validation in the web module's command processing functionality. When the web interface receives user input, it fails to properly sanitize or validate the data before incorporating it into system-level commands. This allows attackers to escape the intended command context and inject their own malicious commands, which are then executed with the privileges of the web service.

Attack Vector

The attack vector is network-based, requiring the attacker to have network access to the vulnerable device's web interface. The exploitation process involves:

1. Identifying a Hikvision Hybrid SAN device with an exposed web interface
2. Crafting a malicious request containing command injection payloads
3. Sending the request to the vulnerable endpoint in the web module
4. The injected commands execute on the underlying operating system

According to external security research documented on Packet Storm Security, this vulnerability has been associated with remote code execution capabilities. Additional technical details regarding SQL injection attack vectors are available in the Packet Storm SQL Injection Advisory.

Detection Methods for CVE-2022-28171

Indicators of Compromise

• Unusual outbound network connections from Hikvision storage devices to unknown external IP addresses
• Unexpected processes or services running on the storage device
• Modified system files or configurations on the storage appliance
• Web server access logs showing malformed or suspicious requests containing shell metacharacters (;, |, &&, $())
• Creation of unauthorized user accounts or SSH keys on the device

Detection Strategies

• Deploy network intrusion detection systems (IDS) with rules to detect command injection patterns in HTTP traffic to Hikvision devices
• Monitor web application firewall (WAF) logs for requests containing shell metacharacters targeting storage device endpoints
• Implement asset inventory scanning to identify all Hikvision Hybrid SAN/Cluster Storage devices in the environment
• Enable verbose logging on Hikvision devices and forward logs to a SIEM for anomaly detection

Monitoring Recommendations

• Establish baseline network behavior for storage devices and alert on deviations such as unexpected DNS queries or outbound connections
• Monitor for firmware integrity changes using file integrity monitoring where supported
• Implement network segmentation alerts to detect any lateral movement attempts originating from storage device network segments
• Review authentication logs for failed login attempts that may indicate reconnaissance activity

How to Mitigate CVE-2022-28171

Immediate Actions Required

• Isolate affected Hikvision Hybrid SAN/Cluster Storage devices from untrusted networks immediately
• Restrict web interface access to trusted management networks only using firewall rules or VLANs
• Disable remote web management if not operationally required
• Conduct a thorough review of device logs for signs of prior exploitation
• Perform a complete inventory of all Hikvision storage products to identify vulnerable firmware versions

Patch Information

Hikvision has released security patches to address this vulnerability. Organizations should immediately consult the Hikvision Security Advisory for specific firmware versions that remediate CVE-2022-28171. Prioritize firmware updates for all affected devices, particularly those exposed to external networks.

Workarounds

• Place affected devices behind a properly configured web application firewall (WAF) that can filter command injection attempts
• Implement network segmentation to restrict access to storage management interfaces from trusted administrative networks only
• Use VPN or jump hosts for remote administration rather than exposing web interfaces directly
• Enable multi-factor authentication for any administrative access to the storage infrastructure where supported

# Example firewall rule to restrict web interface access (Linux iptables)
# Replace 192.168.1.0/24 with your trusted management network
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP