Affected: hikvision DS-K1T804AXX, hikvision DS-K1T341AXX, hikvision DS-K1T671XXX, hikvision DS-K1T343XXX, hikvision DS-K1T341C, hikvision DS-K1T320XXX

Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user successfully logs in. To exploit the vulnerability, attackers have to request the session ID at the same time as a valid user logs in, and gain device operation permissions by forging the IP and session ID of an authenticated user.