CVE-2022-28171: Hikvision DS-A71024 Firmware RCE Flaw

CVE-2022-28171 Overview

A command injection vulnerability exists in the web module of multiple Hikvision Hybrid SAN/Cluster Storage products. Due to insufficient input validation, remote attackers can exploit this vulnerability to execute restricted commands by sending specially crafted messages with malicious commands to the affected device. This vulnerability allows unauthenticated attackers to gain complete control over vulnerable storage systems via network-based attacks.

Critical Impact
Remote attackers can execute arbitrary commands on vulnerable Hikvision storage devices without authentication, potentially leading to complete system compromise, data theft, ransomware deployment, or lateral movement within enterprise networks.

Affected Products

Hikvision DS-A71024 Firmware
Hikvision DS-A71048 Firmware
Hikvision DS-A71072R Firmware
Hikvision DS-A80624S Firmware
Hikvision DS-A81016S Firmware
Hikvision DS-A72024 Firmware
Hikvision DS-A72072R Firmware
Hikvision DS-A80316S Firmware
Hikvision DS-A82024D Firmware
Hikvision DS-A71048R-CVS Firmware
Hikvision DS-A72048R-CVS Firmware

Discovery Timeline

June 27, 2022 - CVE-2022-28171 published to NVD
November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2022-28171

Vulnerability Analysis

The vulnerability resides in the web module of Hikvision Hybrid SAN/Cluster Storage products, where user-supplied input is not properly sanitized before being passed to system command execution functions. The CWE classifications (CWE-78: OS Command Injection and CWE-77: Command Injection) indicate that attackers can inject arbitrary operating system commands through the web interface.

The attack requires no authentication and can be executed remotely over the network with no user interaction required. Successful exploitation grants the attacker complete control over the storage device, compromising the confidentiality, integrity, and availability of both the device and any data stored on it.

Root Cause

The root cause of this vulnerability is insufficient input validation in the web module's command processing functionality. When the web interface receives user input, it fails to properly sanitize or validate the data before incorporating it into system-level commands. This allows attackers to escape the intended command context and inject their own malicious commands, which are then executed with the privileges of the web service.

Attack Vector

The attack vector is network-based, requiring the attacker to have network access to the vulnerable device's web interface. The exploitation process involves:

Identifying a Hikvision Hybrid SAN device with an exposed web interface
Crafting a malicious request containing command injection payloads
Sending the request to the vulnerable endpoint in the web module
The injected commands execute on the underlying operating system

According to external security research documented on Packet Storm Security, this vulnerability has been associated with remote code execution capabilities. Additional technical details regarding SQL injection attack vectors are available in the Packet Storm SQL Injection Advisory.

Detection Methods for CVE-2022-28171

Indicators of Compromise

Unusual outbound network connections from Hikvision storage devices to unknown external IP addresses
Unexpected processes or services running on the storage device
Modified system files or configurations on the storage appliance
Web server access logs showing malformed or suspicious requests containing shell metacharacters (;, |, &&, $())
Creation of unauthorized user accounts or SSH keys on the device

Detection Strategies

Deploy network intrusion detection systems (IDS) with rules to detect command injection patterns in HTTP traffic to Hikvision devices
Monitor web application firewall (WAF) logs for requests containing shell metacharacters targeting storage device endpoints
Implement asset inventory scanning to identify all Hikvision Hybrid SAN/Cluster Storage devices in the environment
Enable verbose logging on Hikvision devices and forward logs to a SIEM for anomaly detection

Monitoring Recommendations

Establish baseline network behavior for storage devices and alert on deviations such as unexpected DNS queries or outbound connections
Monitor for firmware integrity changes using file integrity monitoring where supported
Implement network segmentation alerts to detect any lateral movement attempts originating from storage device network segments
Review authentication logs for failed login attempts that may indicate reconnaissance activity

How to Mitigate CVE-2022-28171

Immediate Actions Required

Isolate affected Hikvision Hybrid SAN/Cluster Storage devices from untrusted networks immediately
Restrict web interface access to trusted management networks only using firewall rules or VLANs
Disable remote web management if not operationally required
Conduct a thorough review of device logs for signs of prior exploitation
Perform a complete inventory of all Hikvision storage products to identify vulnerable firmware versions

Patch Information

Hikvision has released security patches to address this vulnerability. Organizations should immediately consult the Hikvision Security Advisory for specific firmware versions that remediate CVE-2022-28171. Prioritize firmware updates for all affected devices, particularly those exposed to external networks.

Workarounds

Place affected devices behind a properly configured web application firewall (WAF) that can filter command injection attempts
Implement network segmentation to restrict access to storage management interfaces from trusted administrative networks only
Use VPN or jump hosts for remote administration rather than exposing web interfaces directly
Enable multi-factor authentication for any administrative access to the storage infrastructure where supported

bash

# Example firewall rule to restrict web interface access (Linux iptables)
# Replace 192.168.1.0/24 with your trusted management network
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP