CVE-2023-28811
📋 TL;DR
A buffer overflow vulnerability exists in the password recovery feature of Hikvision NVR/DVR devices. Attackers on the same local network can send specially crafted packets to cause device malfunction. This affects Hikvision NVR/DVR models with unpatched firmware.
💻 Affected Systems
- Hikvision NVR devices
- Hikvision DVR devices
📦 What is this software?
Ds 7604ni K1\/4p\/4g\(c\) Firmware by Hikvision
View all CVEs affecting Ds 7604ni K1\/4p\/4g\(c\) Firmware →
Ds 7604ni Q1\/4p\(c\) Firmware by Hikvision
Ds 7608ni K1\/8p\(c\) Firmware by Hikvision
Ds 7608ni K1\/8p\/4g\(c\) Firmware by Hikvision
View all CVEs affecting Ds 7608ni K1\/8p\/4g\(c\) Firmware →
Ds 7608ni Q1\/8p\(c\) Firmware by Hikvision
Ds 7608ni Q2\/8p\(c\) Firmware by Hikvision
Ds 7616ni Q2\/16p\(c\) Firmware by Hikvision
Dvr Firmware by Hikvision
⚠️ Risk & Real-World Impact
Worst Case
Complete device crash or denial of service, potentially requiring physical reset or replacement.
Likely Case
Device becomes unresponsive or reboots, disrupting surveillance operations.
If Mitigated
No impact if device is patched or isolated from internal threats.
🎯 Exploit Status
Exploitation requires LAN access and knowledge of device IP. No authentication needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware versions released after March 2023 (check vendor advisory for exact versions)
Vendor Advisory: https://www.hikvision.com/en/support/cybersecurity/security-advisory/buffer-overflow-vulnerability-in-hikvision-nvr-dvr-devices/
Restart Required: Yes
Instructions:
1. Visit Hikvision security advisory. 2. Download latest firmware for your device model. 3. Upload firmware via web interface. 4. Reboot device after installation.
🔧 Temporary Workarounds
Disable password recovery feature
allTurn off password recovery functionality if not needed
Network segmentation
allIsolate surveillance devices on separate VLAN
🧯 If You Can't Patch
- Segment devices on isolated network VLAN
- Implement strict firewall rules to limit device communication to authorized hosts only
🔍 How to Verify
Check if Vulnerable:
Check firmware version against vendor advisory; if pre-March 2023 and unpatched, assume vulnerableCheck Version:
Check via device web interface: System > Maintenance > Version InformationVerify Fix Applied:
Verify firmware version matches patched version in vendor advisory📡 Detection & Monitoring
Log Indicators:
- Unexpected device reboots
- Password recovery attempt logs
- System crash logs
Network Indicators:
- Unusual UDP/TCP packets to device port 8000 (default Hikvision port)
- Multiple connection attempts from single internal IP
SIEM Query:
source_ip INTERNAL AND dest_port 8000 AND protocol UDP AND packet_size > normal_threshold