Vulnerabilidades de Hikvision
CVEs publicadas que afetam produtos de Hikvision: 14 registro(s), com severidade, exploração e correções.
DS-7204HGHI-F1 2DS-7104HGHI-F1 2iSecure Center 2CSMP iSecure Center 2Ds-7204hghi-f1 Firmware 2Ds-7104hghi-f1 Firmware 2DS-K5033 1Ds-2cd2112-i Firmware 1Ds-2cd2132-i Firmware 1Ds-2cd2212-i5 Firmware 1Ds-2cd2232-i5 Firmware 1Ds-2cd2312-i Firmware 1Ds-2cd2332-i Firmware 1Ds-2cd2412f-i(w) Firmware 1Ds-2cd2432f-i(w) Firmware 1Ds-2cd2512f-i(s) Firmware 1Ds-2cd2532f-i(s) Firmware 1Ds-2cd2612f-i(s) Firmware 1Ds-2cd2632f-i(s) Firmware 1Ds-2cd2712f-i(s) Firmware 1Ds-2cd2732f-i(s) Firmware 1Ds-2cd2t32-i3 Firmware 1Ds-2cd2t32-i5 Firmware 1Ds-2cd2t32-i8 Firmware 1Ds-2cd4012f-(a) Firmware 1Ds-2cd4012f-(p) Firmware 1Ds-2cd4012f-(w) Firmware 1Ds-2cd4012fwd-(a) Firmware 1Ds-2cd4012fwd-(p) Firmware 1Ds-2cd4012fwd-(w) Firmware 1Ds-2cd4024f-(a) Firmware 1Ds-2cd4024f-(p) Firmware 1Ds-2cd4024f-(w) Firmware 1Ds-2cd4032fwd-(a) Firmware 1Ds-2cd4032fwd-(p) Firmware 1Ds-2cd4032fwd-(w) Firmware 1Ds-2cd4112f-i(z) Firmware 1Ds-2cd4124f-i(z) Firmware 1Ds-2cd4132fwd-i(z) Firmware 1Ds-2cd4212f-i(h) Firmware 1
CVE-2026-32684
Baixa · 2.9
CWE-732 12/05/2026
Incorrect Permission Assignment for Critical Resource em Hikvision Hik-Connect APP
The application does not impose strict enough restrictions on directory access permissions, posing a risk that other malicious applications could obtain sensitive information.
CVE-2026-3828
Alta · 7.2
CWE-78 09/05/2026
OS Command Injection em Hikvision DS-3E1310P-SI
Some Hikvision switch products (discontinued since December 2023) are vulnerable to authenticated remote command execution due to insufficient input validation. Attackers with valid credentials can exploit this flaw by sending crafted packets containing malicious commands to affected devices, leading to arbitrary command execution.
CVE-2026-1749
Média · 6.8
CWE-284 09/05/2026
Improper Access Control em Hikvision HikCentral Professional
There is an Access Control Vulnerability in some HikCentral Professional versions. This could allow an unauthenticated user to obtain the admin permission.
CVE-2026-0709
Alta · 7.2
CWE-78 30/01/2026
OS Command Injection em Hikvision DS-3WAP521-SI
Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input validation. Attackers with valid credentials can exploit this flaw by sending crafted packets containing malicious commands to affected devices, leading to arbitrary command execution.
CVE-2025-66177
Alta · 8.8
CWE-121 13/01/2026
Stack-based Buffer Overflow em Hikvision DS-96xxxNI-Hx
There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision NVR/DVR/CVR/IPC models. If exploited, an attacker on the same local area network (LAN) could cause the device to malfunction by sending specially crafted packets to an unpatched device.
CVE-2025-66176
Alta · 8.8
CWE-121 13/01/2026
Stack-based Buffer Overflow em Hikvision Ds-k1t331 Firmware
There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision Access Control Products. If exploited, an attacker on the same local area network (LAN) could cause the device to malfunction by sending specially crafted packets to an unpatched device.
CVE-2025-66174
Média · 6.8
CWE-287 19/12/2025
Improper Authentication em Hikvision Ds-7104hghi-f1 Firmware
There is an improper authentication vulnerability in some Hikvision DVR products. Due to the improper implementation of authentication for the serial port, an attacker with physical access could exploit this vulnerability by connecting to the affected products and run a series of commands.
CVE-2025-66173
Média · 6.2
CWE-269 19/12/2025
Improper Privilege Management em Hikvision Ds-7104hghi-f1 Firmware
There is a privilege escalation vulnerability in some Hikvision DVR products. Due to the improper implementation of authentication for the serial port, an attacker with physical access could exploit this vulnerability by connecting to the affected products and gaining access to an unrestricted shell environment.
CVE-2024-58274
Alta · 8.3
CWE-78 22/10/2025
OS Command Injection em Hikvision CSMP iSecure Center
Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2024-08-01 allows execution of a command within $( ) in /center/api/installation/detection JSON data, as exploited in the wild in 2024 and 2025.
CVE-2023-53691
Alta · 8.3
CWE-24 22/10/2025
Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through…
Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2023-06-25 allows file upload via /center/api/files directory traversal, as exploited in the wild in 2024 and 2025.
CVE-2023-28815
Crítica · 9.8
CWE-141 17/10/2025
Injeção de comando no Hikvision iSecure Center (CVE-2023-28815)
Algumas versões do iSecure Center da Hikvision contêm validação insuficiente de parâmetros, resultando em uma vulnerabilidade de injeção de comando. Atacantes podem explorar isso para obter privilégios de plataforma e executar comandos arbitrários no sistema. O iSecure Center é um software lançado apenas para o mercado doméstico chinês, sem lançamento no exterior.
CVE-2023-28814
Crítica · 9.8
CWE-434 17/10/2025
Upload irrestrito de arquivos no Hikvision iSecure Center (CVE-2023-28814)
Algumas versões do produto iSecure Center da Hikvision apresentam uma vulnerabilidade de controle impróprio de upload de arquivos. Devido à verificação imprópria do arquivo a ser enviado, atacantes podem enviar arquivos maliciosos ao servidor. O iSecure Center é um software lançado apenas para o mercado doméstico chinês, sem versão para o exterior.
CVE-2021-36260
Crítica · 9.8
KEV Urgente · 83 Exploit público CWE-78 22/09/2021
Hikvision Improper Input Validation
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.
CVE-2017-7921
Crítica · 9.8
KEV Urgente · 79 Exploit público CWE-287 05/05/2017
Hikvision Multiple Products Improper Authentication Vulnerability
An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.