CVE-2023-28813

View on CVE.org

Published Nov 23, 2023 CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Description

An attacker could exploit a vulnerability by sending crafted messages to computers installed with this plug-in to modify plug-in parameters, which could cause affected computers to download malicious files.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Hikvision

LocalServiceComponents

affected

Version	Status	Constraints
`version 1.0.0.78 and the versions prior to it`	affected	—

Configuration 1 [-]

cpe:2.3:a:hikvision:localservicecomponents:*:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2023-32448	An attacker could exploit a vulnerability by sending crafted messages to computers installed with this plug-in to modify plug-in parameters, which could cause affected computers to download malicious files.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.627% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-hikvision-web-browser-plug-in-locals/

History

No history.

Subscriptions

Hikvision Localservicecomponents

Weaknesses

NVD-CWE-noinfo

Sources

CVE record Updated: Aug 2, 2024, 1:51 PM

Status: PUBLISHED
Assigner: hikvision
Published: Nov 23, 2023, 8:37 AM
Updated: Aug 2, 2024, 1:51 PM
Reserved: Mar 23, 2023, 7:49 PM

View source JSON

Vulnrichment No data

No data.

NVD Updated: Jun 17, 2026, 5:48 AM

Status: Modified
Published: Nov 23, 2023, 9:15 AM
Modified: Jun 17, 2026, 5:48 AM

View source JSON

Red Hat No data

No data.

OpenCVE enrichment No data

No data.

{"affected": [{"affectedData": [{"product": "LocalServiceComponents", "vendor": "Hikvision", "versions": [{"status": "affected", "version": "version 1.0.0.78 and the versions prior to it"}]}], "source": "hsrc@hikvision.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:hikvision:localservicecomponents:*:*:*:*:*:*:*:*", "matchCriteriaId": "45D87F15-B878-4801-8095-57D968B98267", "versionEndIncluding": "1.0.0.78", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An attacker could exploit a vulnerability by sending crafted messages to computers installed with this plug-in to modify plug-in parameters, which could cause affected computers to download malicious files. "}, {"lang": "es", "value": "Un atacante podr\u00eda aprovechar una vulnerabilidad enviando mensajes manipulados a las maquinas instaladas con este complemento para modificar los par\u00e1metros del complemento, lo que podr\u00eda provocar que las maquinas afectadas descarguen archivos maliciosos."}], "id": "CVE-2023-28813", "lastModified": "2026-06-17T05:48:49.807", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "hsrc@hikvision.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-11-23T09:15:33.190", "references": [{"source": "hsrc@hikvision.com", "tags": ["Vendor Advisory"], "url": "https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-hikvision-web-browser-plug-in-locals/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-hikvision-web-browser-plug-in-locals/"}], "sourceIdentifier": "hsrc@hikvision.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}