CVE-2023-28810 PoC — Hikvision Access Control 安全漏洞

Source

https://github.com/skylightcyber/CVE-2023-28810

Associated Vulnerability

Title: Hikvision Access Control 安全漏洞 (CVE-2023-28810)
Description:Some access control/intercom products have unauthorized modification of device network configuration vulnerabilities. Attackers can modify device network configuration by sending specific data packets to the vulnerable interface within the same local network.

Description

Exploit code for CVE-2023-28810

Readme

# CVE-2023-28810
Exploit code for CVE-2023-28810.

## udp-config-changer.py
Change the running configuration of a target hikvision intercom without needing any authentication.

## udp-password-brute.py
Attempt to recover the admin password for the device via brute force guessing (wordlist not supplied).

## SIP-ghost-caller.py
Bonus code for making the targeted intercom ring via unauthenticated SIP INVITE message.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →