Hikvision vulnerabilities

Published CVEs affecting Hikvision products: 20 record(s), with severity, exploitation and fixes.

Exploited only (KEV) →

CVE-2026-16843 High · 7.2 CWE-78 Jul 31, 2026

OS Command Injection in Hikvision DS-3WAP521-SI

Some Hikvision Networking Products are vulnerable to authenticated command execution due to insufficient input validation. Attackers with valid credentials can exploit this flaw by sending crafted packets containing malicious commands to affected devices, leading to arbitrary command execution.

CVE-2026-61392 Medium · 5.3 CWE-200 Jul 22, 2026

Exposure of Sensitive Information in Hikvision DS-2CD Series

There is a information disclosure vulnerability in some Hikvision cameras, allowing unauthenticated attackers to obtain partial information from the device’s memory.

CVE-2026-61391 High · 7.2 CWE-121 Jul 22, 2026

Stack-based Buffer Overflow in Hikvision DS-2CD Series

There is a stack-based buffer overflow vulnerability in some Hikvision cameras, which may allow authenticated attackers to cause device malfunction by sending specially crafted packets.

CVE-2026-61390 High · 7.7 CWE-122 Jul 22, 2026

Heap-based Buffer Overflow in Hikvision DS-2CD Series

There is a heap buffer overflow vulnerability in some Hikvision cameras, which may allow unauthenticated attackers to cause device malfunction by sending specially crafted packets.

CVE-2026-57600 High · 7.5 CWE-20 Jul 22, 2026

Improper Input Validation in Hikvision DS-2CD Series

Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthenticated attackers to retrieve partial sensitive data.

CVE-2026-57599 Medium · 6.6 CWE-269 Jul 22, 2026

Improper Privilege Management in Hikvision DS-2CD Series

There is a privilege escalation vulnerability in some Hikvision cameras. Due to incorrect permission allocation in the device program, attackers can escalate privileges and gain full control of the device after authenticating via SSH.

CVE-2026-32684 Low · 2.9 CWE-732 May 12, 2026

Incorrect Permission Assignment for Critical Resource in Hikvision Hik-Connect APP

The application does not impose strict enough restrictions on directory access permissions, posing a risk that other malicious applications could obtain sensitive information.

CVE-2026-3828 High · 7.2 CWE-78 May 9, 2026

OS Command Injection in Hikvision DS-3E1310P-SI

Some Hikvision switch products (discontinued since December 2023) are vulnerable to authenticated remote command execution due to insufficient input validation. Attackers with valid credentials can exploit this flaw by sending crafted packets containing malicious commands to affected devices, leading to arbitrary command execution.

CVE-2026-1749 Medium · 6.8 CWE-284 May 9, 2026

Improper Access Control in Hikvision HikCentral Professional

There is an Access Control Vulnerability in some HikCentral Professional versions. This could allow an unauthenticated user to obtain the admin permission.

CVE-2026-0709 High · 7.2 CWE-78 Jan 30, 2026

OS Command Injection in Hikvision DS-3WAP521-SI

Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input validation. Attackers with valid credentials can exploit this flaw by sending crafted packets containing malicious commands to affected devices, leading to arbitrary command execution.

CVE-2025-66177 High · 8.8 CWE-121 Jan 13, 2026

Stack-based Buffer Overflow in Hikvision DS-96xxxNI-Hx

There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision NVR/DVR/CVR/IPC models. If exploited, an attacker on the same local area network (LAN) could cause the device to malfunction by sending specially crafted packets to an unpatched device.

CVE-2025-66176 High · 8.8 CWE-121 Jan 13, 2026

Stack-based Buffer Overflow in Hikvision Ds-k1t331 Firmware

There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision Access Control Products. If exploited, an attacker on the same local area network (LAN) could cause the device to malfunction by sending specially crafted packets to an unpatched device.

CVE-2025-66174 Medium · 6.8 CWE-287 Dec 19, 2025

Improper Authentication in Hikvision Ds-7104hghi-f1 Firmware

There is an improper authentication vulnerability in some Hikvision DVR products. Due to the improper implementation of authentication for the serial port, an attacker with physical access could exploit this vulnerability by connecting to the affected products and run a series of commands.

CVE-2025-66173 Medium · 6.2 CWE-269 Dec 19, 2025

Improper Privilege Management in Hikvision Ds-7104hghi-f1 Firmware

There is a privilege escalation vulnerability in some Hikvision DVR products. Due to the improper implementation of authentication for the serial port, an attacker with physical access could exploit this vulnerability by connecting to the affected products and gaining access to an unrestricted shell environment.

CVE-2024-58274 High · 8.3 CWE-78 Oct 22, 2025

OS Command Injection in Hikvision CSMP iSecure Center

Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2024-08-01 allows execution of a command within $( ) in /center/api/installation/detection JSON data, as exploited in the wild in 2024 and 2025.

CVE-2023-53691 High · 8.3 CWE-24 Oct 22, 2025

Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through…

Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2023-06-25 allows file upload via /center/api/files directory traversal, as exploited in the wild in 2024 and 2025.

CVE-2023-28815 Critical · 9.8 CWE-141 Oct 17, 2025

Hikvision iSecure Center Command Injection (CVE-2023-28815)

Some versions of Hikvision's iSecure Center Product contain insufficient parameter validation, resulting in a command injection vulnerability. Attackers may exploit this to gain platform privileges and execute arbitrary commands on the system.iSecure Center is software released for China's domestic market only, with no overseas release.

CVE-2023-28814 Critical · 9.8 CWE-434 Oct 17, 2025

Hikvision iSecure Center Unrestricted File Upload (CVE-2023-28814)

Some versions of Hikvision's iSecure Center Product have an improper file upload control vulnerability. Due to the improper verification of file to be uploaded, attackers may upload malicious files to the server. iSecure Center is software released for China's domestic market only, with no overseas release.

CVE-2021-36260 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-78 Sep 22, 2021

Hikvision Improper Input Validation

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.

CVE-2017-7921 Critical · 9.8 KEV Urgent · 79 Public exploit CWE-287 May 5, 2017

Hikvision Multiple Products Improper Authentication Vulnerability

An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.