Vulnerabilities

Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, allowing authenticated low-privileged users to obtain device Wi-Fi configuration information through these interfaces.

There is an Vulnerability in some HikCentral Access Control versions.

Some Hikvision intercom products utilize an immutable factory value which should be obtained from local network or physical interaction with the device within their main card, which may allow attackers to forge a legitim…

Some Hikvision Networking Products are vulnerable to authenticated command execution due to insufficient input validation.

There is a information disclosure vulnerability in some Hikvision cameras, allowing unauthenticated attackers to obtain partial information from the device’s memory.

There is a stack-based buffer overflow vulnerability in some Hikvision cameras, which may allow authenticated attackers to cause device malfunction by sending specially crafted packets.

There is a heap buffer overflow vulnerability in some Hikvision cameras, which may allow unauthenticated attackers to cause device malfunction by sending specially crafted packets.

Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthenticated attackers to retrieve partial sensitive data.

There is a privilege escalation vulnerability in some Hikvision cameras.

The application does not impose strict enough restrictions on directory access permissions, posing a risk that other malicious applications could obtain sensitive information.

Some Hikvision switch products (discontinued since December 2023) are vulnerable to authenticated remote command execution due to insufficient input validation.

There is an Access Control Vulnerability in some HikCentral Professional versions.

Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input validation.

There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision NVR/DVR/CVR/IPC models.

There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision Access Control Products.

There is an improper authentication vulnerability in some Hikvision DVR products.

There is a privilege escalation vulnerability in some Hikvision DVR products.

Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2024-08-01 allows execution of a command within $( ) in /center/api/installation/detection JSON data, as exploited in the wild in 2024 an…

Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2023-06-25 allows file upload via /center/api/files directory traversal, as exploited in the wild in 2024 and 2025.

Some versions of Hikvision's iSecure Center Product contain insufficient parameter validation, resulting in a command injection vulnerability.

Some versions of Hikvision's iSecure Center Product have an improper file upload control vulnerability.

There is an Access Control Vulnerability in some HikCentral Professional versions.

There is an Unquoted Service Path Vulnerability in some HikCentral FocSign versions.

There is a CSV Injection Vulnerability in some HikCentral Master Lite versions.

An unauthenticated remote command execution vulnerability exists in the applyCT component of the Hikvision Integrated Security Management Platform due to the use of a vulnerable version of the Fastjson library.