Critical Hikvision wireless bridge vulnerability addressed

SecurityWeek reports that Chinese video surveillance firm Hikvision has issued firmware fixes for a critical flaw impacting two of its wireless bridge offerings, which could be exploited to facilitate remote CCTV hacking. Threat actors could leverage the flaw, tracked as CVE-2022-28173, by delivering specially crafted messages to vulnerable DS-3WF0AC-2NT and DS-3WF01C-2N/O instances to achieve administrator permissions. Such a vulnerability stems from improper parameter handling by the web-based management interface of the wireless bridge offerings, according to Redinent Innovations, whose researchers Arko Dhar and Souvik Kandar first reported the bug. "Post exploitation, the administrative session persists with full access to all functions of the bridge interface," said Redinent in an advisory. Dhar added that successful exploitation could prompt network traffic interception or CCTV system hacking. "An attacker can disable or shut down the video feed as part of a planned physical incident for example, coordinated robbery or theft or snoop on people," said Dhar. Meanwhile, Hikvision reassured that U.S. products are not affected by the vulnerability.