https://vulnogram.org/ Most recent CVEs assigned by Hangzhou Hikvision Digital Technology Co., Ltd. (hikvision). https://vulnogram.org/seaview/icons/hikvision.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-85543 https://vulnogram.org/CVE-2026-85543 Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, allowing authenticated low-privileged users to obtain device Wi-Fi configuration information through these interfaces. Medium Thu, 10 Sep 2026 12:47:29 GMT https://vulnogram.org/CVE-2026-85545 https://vulnogram.org/CVE-2026-85545 There is an Vulnerability in some HikCentral Access Control versions. Authenticated low-privilege users can invoke API interfaces that their role is not authorized to access. High Thu, 10 Sep 2026 12:27:07 GMT https://vulnogram.org/CVE-2026-85544 https://vulnogram.org/CVE-2026-85544 Some Hikvision intercom products utilize an immutable factory value which should be obtained from local network or physical interaction with the device within their main card, which may allow attackers to forge a legitimate main card, thereby gaining… Medium Thu, 10 Sep 2026 12:26:00 GMT https://vulnogram.org/CVE-2026-16843 https://vulnogram.org/CVE-2026-16843 Some Hikvision Networking Products are vulnerable to authenticated command execution due to insufficient input validation. Attackers with valid credentials can exploit this flaw by sending crafted packets containing malicious commands to affected dev… High Fri, 31 Jul 2026 09:31:30 GMT https://vulnogram.org/CVE-2026-61392 https://vulnogram.org/CVE-2026-61392 There is a information disclosure vulnerability in some Hikvision cameras, allowing unauthenticated attackers to obtain partial information from the device’s memory. Medium Network Exploitable Wed, 22 Jul 2026 11:03:11 GMT https://vulnogram.org/CVE-2026-61391 https://vulnogram.org/CVE-2026-61391 There is a stack-based buffer overflow vulnerability in some Hikvision cameras, which may allow authenticated attackers to cause device malfunction by sending specially crafted packets. High Wed, 22 Jul 2026 11:02:27 GMT https://vulnogram.org/CVE-2026-61390 https://vulnogram.org/CVE-2026-61390 There is a heap buffer overflow vulnerability in some Hikvision cameras, which may allow unauthenticated attackers to cause device malfunction by sending specially crafted packets. High Network Exploitable Wed, 22 Jul 2026 11:02:00 GMT https://vulnogram.org/CVE-2026-57600 https://vulnogram.org/CVE-2026-57600 Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthenticated attackers to retrieve partial sensitive data. High Network Exploitable Wed, 22 Jul 2026 11:01:36 GMT https://vulnogram.org/CVE-2026-57599 https://vulnogram.org/CVE-2026-57599 There is a privilege escalation vulnerability in some Hikvision cameras. Due to incorrect permission allocation in the device program, attackers can escalate privileges and gain full control of the device after authenticating via SSH. Medium Wed, 22 Jul 2026 11:00:49 GMT https://vulnogram.org/CVE-2026-32684 https://vulnogram.org/CVE-2026-32684 The application does not impose strict enough restrictions on directory access permissions, posing a risk that other malicious applications could obtain sensitive information. Low Tue, 12 May 2026 10:51:08 GMT https://vulnogram.org/CVE-2026-32683 https://vulnogram.org/CVE-2026-32683 Some EZVIZ products utilize older versions of cloud feature modules with legacy API interfaces, which pose a data transmission risk. Attackers can exploit this by eavesdropping on network requests to obtain data.Users are advised to upgrade the app t… Medium Sat, 09 May 2026 08:29:09 GMT https://vulnogram.org/CVE-2026-3828 https://vulnogram.org/CVE-2026-3828 Some Hikvision switch products (discontinued since December 2023) are vulnerable to authenticated remote command execution due to insufficient input validation. Attackers with valid credentials can exploit this flaw by sending crafted packets contain… High Sat, 09 May 2026 08:27:55 GMT https://vulnogram.org/CVE-2026-1749 https://vulnogram.org/CVE-2026-1749 There is an Access Control Vulnerability in some HikCentral Professional versions. This could allow an unauthenticated user to obtain the admin permission. Medium Network Exploitable Sat, 09 May 2026 08:27:15 GMT https://vulnogram.org/CVE-2026-22626 https://vulnogram.org/CVE-2026-22626 Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can cause abnormal device behavior by crafting specific messages. Medium Fri, 30 Jan 2026 11:03:29 GMT https://vulnogram.org/CVE-2026-22625 https://vulnogram.org/CVE-2026-22625 Improper handling of filenames in certain HIKSEMI NAS products may lead to the exposure of sensitive system files. Medium Fri, 30 Jan 2026 11:03:14 GMT https://vulnogram.org/CVE-2026-22624 https://vulnogram.org/CVE-2026-22624 Due to inadequate access control, authenticated users of certain HIKSEMI NAS products can manipulate other users' file resources without proper authorization. Medium Fri, 30 Jan 2026 11:03:02 GMT https://vulnogram.org/CVE-2026-22623 https://vulnogram.org/CVE-2026-22623 Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can execute arbitrary commands on the device by crafting specific messages. High Fri, 30 Jan 2026 11:02:26 GMT https://vulnogram.org/CVE-2026-0709 https://vulnogram.org/CVE-2026-0709 Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input validation. Attackers with valid credentials can exploit this flaw by sending crafted packets containing malicious commands to affected… High Fri, 30 Jan 2026 11:01:55 GMT https://vulnogram.org/CVE-2025-66177 https://vulnogram.org/CVE-2025-66177 There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision NVR/DVR/CVR/IPC models. If exploited, an attacker on the same local area network (LAN) could cause the device to malfunction by sending specially crafted… High Tue, 13 Jan 2026 01:47:54 GMT https://vulnogram.org/CVE-2025-66176 https://vulnogram.org/CVE-2025-66176 There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision Access Control Products. If exploited, an attacker on the same local area network (LAN) could cause the device to malfunction by sending specially crafte… High Tue, 13 Jan 2026 01:47:27 GMT https://vulnogram.org/CVE-2025-66174 https://vulnogram.org/CVE-2025-66174 There is an improper authentication vulnerability in some Hikvision DVR products. Due to the improper implementation of authentication for the serial port, an attacker with physical access could exploit this vulnerability by connecting to the affecte… Medium Network Exploitable Fri, 19 Dec 2025 06:39:51 GMT https://vulnogram.org/CVE-2025-66173 https://vulnogram.org/CVE-2025-66173 There is a privilege escalation vulnerability in some Hikvision DVR products. Due to the improper implementation of authentication for the serial port, an attacker with physical access could exploit this vulnerability by connecting to the affected pr… Medium Fri, 19 Dec 2025 06:39:38 GMT https://vulnogram.org/CVE-2023-28815 https://vulnogram.org/CVE-2023-28815 Some versions of Hikvision's iSecure Center Product contain insufficient parameter validation, resulting in a command injection vulnerability. Attackers may exploit this to gain platform privileges and execute arbitrary commands on the system.iSecure… Critical Network Exploitable Fri, 17 Oct 2025 11:07:26 GMT https://vulnogram.org/CVE-2023-28814 https://vulnogram.org/CVE-2023-28814 Some versions of Hikvision's iSecure Center Product have an improper file upload control vulnerability. Due to the improper verification of file to be uploaded, attackers may upload malicious files to the server. iSecure Center is software released f… Critical Network Exploitable Fri, 17 Oct 2025 11:07:06 GMT https://vulnogram.org/CVE-2025-39247 https://vulnogram.org/CVE-2025-39247 There is an Access Control Vulnerability in some HikCentral Professional versions. This could allow an unauthenticated user to obtain the admin permission. High Network Exploitable Fri, 29 Aug 2025 01:40:31 GMT https://vulnogram.org/CVE-2025-39246 https://vulnogram.org/CVE-2025-39246 There is an Unquoted Service Path Vulnerability in some HikCentral FocSign versions. This could allow an authenticated user to potentially enable escalation of privilege via local access. Medium Network Exploitable Fri, 29 Aug 2025 01:39:53 GMT https://vulnogram.org/CVE-2025-39245 https://vulnogram.org/CVE-2025-39245 There is a CSV Injection Vulnerability in some HikCentral Master Lite versions. This could allow an attacker to inject executable commands via malicious CSV data. Medium Network Exploitable Fri, 29 Aug 2025 01:38:46 GMT https://vulnogram.org/CVE-2025-39240 https://vulnogram.org/CVE-2025-39240 Some Hikvision Wireless Access Point are vulnerable to authenticated remote command execution due to insufficient input validation. Attackers with valid credentials can exploit this flaw by sending crafted packets containing malicious commands to aff… High Fri, 13 Jun 2025 07:10:39 GMT https://vulnogram.org/CVE-2024-47486 https://vulnogram.org/CVE-2024-47486 There is an XSS vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could inject scripts into certain pages by building malicious data. Low Fri, 18 Oct 2024 08:33:07 GMT https://vulnogram.org/CVE-2024-47487 https://vulnogram.org/CVE-2024-47487 There is a SQL injection vulnerability in some HikCentral Professional versions. This could allow an authenticated user to execute arbitrary SQL queries. High Fri, 18 Oct 2024 08:32:45 GMT https://vulnogram.org/CVE-2024-47485 https://vulnogram.org/CVE-2024-47485 There is a CSV injection vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could build malicious data to generate executable commands in the CSV file. Medium Fri, 18 Oct 2024 08:29:38 GMT https://vulnogram.org/CVE-2024-29949 https://vulnogram.org/CVE-2024-29949 There is a command injection vulnerability in some Hikvision NVRs. This could allow an authenticated user with administrative rights to execute arbitrary commands. High Tue, 02 Apr 2024 11:07:41 GMT https://vulnogram.org/CVE-2024-29948 https://vulnogram.org/CVE-2024-29948 There is an out-of-bounds read vulnerability in some Hikvision NVRs. An authenticated attacker could exploit this vulnerability by sending specially crafted messages to a vulnerable device, causing a service abnormality. Low Tue, 02 Apr 2024 11:07:04 GMT https://vulnogram.org/CVE-2024-29947 https://vulnogram.org/CVE-2024-29947 There is a NULL dereference pointer vulnerability in some Hikvision NVRs. Due to an insufficient validation of a parameter in a message, an attacker may send specially crafted messages to an affected product, causing a process abnormality. Low Tue, 02 Apr 2024 11:06:42 GMT https://vulnogram.org/CVE-2024-25064 https://vulnogram.org/CVE-2024-25064 Due to insufficient server-side validation, an attacker with login privileges could access certain resources that the attacker should not have access to by changing parameter values. Medium Sat, 02 Mar 2024 02:56:19 GMT https://vulnogram.org/CVE-2024-25063 https://vulnogram.org/CVE-2024-25063 Due to insufficient server-side validation, a successful exploit of this vulnerability could allow an attacker to gain access to certain URLs that the attacker should not have access to. High Network Exploitable Sat, 02 Mar 2024 02:54:27 GMT https://vulnogram.org/CVE-2023-28813 https://vulnogram.org/CVE-2023-28813 An attacker could exploit a vulnerability by sending crafted messages to computers installed with this plug-in to modify plug-in parameters, which could cause affected computers to download malicious files. High Network Exploitable Thu, 23 Nov 2023 08:37:35 GMT https://vulnogram.org/CVE-2023-28812 https://vulnogram.org/CVE-2023-28812 There is a buffer overflow vulnerability in a web browser plug-in could allow an attacker to exploit the vulnerability by sending crafted messages to computers installed with this plug-in, which could lead to arbitrary code execution or cause process… Critical Network Exploitable Thu, 23 Nov 2023 08:35:01 GMT https://vulnogram.org/CVE-2023-28811 https://vulnogram.org/CVE-2023-28811 There is a buffer overflow in the password recovery feature of Hikvision NVR/DVR models. If exploited, an attacker on the same local area network (LAN) could cause the device to malfunction by sending specially crafted packets to an unpatched device. High Thu, 23 Nov 2023 06:42:01 GMT https://vulnogram.org/CVE-2023-28810 https://vulnogram.org/CVE-2023-28810 Some access control/intercom products have unauthorized modification of device network configuration vulnerabilities. Attackers can modify device network configuration by sending specific data packets to the vulnerable interface within the same local… Medium Thu, 15 Jun 2023 00:00:00 GMT https://vulnogram.org/CVE-2023-28809 https://vulnogram.org/CVE-2023-28809 Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user successfully logs in. To exploit the vulnerability, attackers have to request the session ID at the same time as… High Network Exploitable Thu, 15 Jun 2023 00:00:00 GMT https://vulnogram.org/CVE-2023-28808 https://vulnogram.org/CVE-2023-28808 Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices. Critical Network Exploitable Tue, 11 Apr 2023 00:00:00 GMT https://vulnogram.org/CVE-2022-28173 https://vulnogram.org/CVE-2022-28173 The web server of some Hikvision wireless bridge products have an access control vulnerability which can be used to obtain the admin permission. The attacker can exploit the vulnerability by sending crafted messages to the affected devices. Critical Network Exploitable Wed, 21 Dec 2022 01:21:43 GMT https://vulnogram.org/CVE-2022-28172 https://vulnogram.org/CVE-2022-28172 The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to XSS attack by sending messages with malicious commands… Medium Network Exploitable Mon, 27 Jun 2022 17:50:40 GMT https://vulnogram.org/CVE-2022-28171 https://vulnogram.org/CVE-2022-28171 The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to execute restricted commands by sending messages with m… High Network Exploitable Mon, 27 Jun 2022 17:48:51 GMT https://vulnogram.org/CVE-2021-36260 https://vulnogram.org/CVE-2021-36260 A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands. Critical Known Exploited Network Exploitable Wed, 22 Sep 2021 12:07:55 GMT https://vulnogram.org/CVE-2018-6414 https://vulnogram.org/CVE-2018-6414 A buffer overflow vulnerability in the web server of some Hikvision IP Cameras allows an attacker to send a specially crafted message to affected devices. Due to the insufficient input validation, successful exploit can corrupt memory and lead to arb… Mon, 13 Aug 2018 15:00:00 GMT https://vulnogram.org/CVE-2018-6413 https://vulnogram.org/CVE-2018-6413 There is a buffer overflow in the Hikvision Camera DS-2CD9111-S of V4.1.2 build 160203 and before, and this vulnerability allows remote attackers to launch a denial of service attack (service interruption) via a crafted network setting interface requ… Wed, 18 Apr 2018 15:00:00 GMT