CVE-2022-28171: Hikvision Hybrid SAN web module command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication or user interaction, and public exploit references make this a high-risk remote code execution flaw on storage infrastructure.

What it is

The web module in several Hikvision Hybrid SAN/Cluster Storage products fails to validate input, allowing an attacker to send messages containing malicious commands that the device executes. Because the affected devices are storage systems, successful exploitation can compromise both the device and the data it holds.

Impact

An attacker can execute restricted commands on the affected device, gaining control over the storage appliance and potentially its stored data. The CVSS vector indicates full loss of confidentiality, integrity and availability.

Attack surface

Reachable over the network through the web module; the CVSS vector shows no privileges and no user interaction required. Any host that can reach the device's web interface can attempt the attack.

Exploitation

Not listed in CISA KEV, but EPSS is high (0.516 probability, 98.9th percentile) and Packet Storm references are tagged Exploit, indicating public exploit material exists.

What to do

• Apply the vendor security advisory fix for the affected Hybrid SAN firmware models as soon as possible.
• Restrict network access to the device web interface to trusted management networks only.
• Do not expose the web module to the internet; place it behind a firewall or VPN.
• Monitor vendor advisories for updated firmware and re-check affected model list before patching.
• Where patching is delayed, isolate affected storage devices on a segmented management VLAN.

Detection

• Inspect web server and device logs for requests containing shell metacharacters or command strings in parameters.
• Alert on unexpected outbound connections or process execution from the storage appliance.
• Monitor for unusual authentication or configuration changes on the device web interface.
• Use network monitoring to flag HTTP requests to the device web module from untrusted sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.