# cve.now: Hikvision

The newest entries naming Hikvision as an affected vendor (up to 200), of 48 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-85543](https://cve.now/CVE-2026-85543.md): Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, allowing authenticated low-privileged users (CVSS 4.3)
- [CVE-2026-85545](https://cve.now/CVE-2026-85545.md): There is an Vulnerability in some HikCentral Access Control versions. (CVSS 7.1)
- [CVE-2026-85544](https://cve.now/CVE-2026-85544.md): Some Hikvision intercom products utilize an immutable factory value which should be obtained from local network or physical interaction with (CVSS 6.1)
- [CVE-2026-16843](https://cve.now/CVE-2026-16843.md): Some Hikvision Networking Products are vulnerable to authenticated command execution due to insufficient input validation. (CVSS 7.2)
- [CVE-2026-61392](https://cve.now/CVE-2026-61392.md): There is a information disclosure vulnerability in some Hikvision cameras, allowing unauthenticated attackers to obtain partial information (CVSS 5.3)
- [CVE-2026-61391](https://cve.now/CVE-2026-61391.md): There is a stack-based buffer overflow vulnerability in some Hikvision cameras, which may allow authenticated attackers to cause device malf (CVSS 7.2)
- [CVE-2026-61390](https://cve.now/CVE-2026-61390.md): There is a heap buffer overflow vulnerability in some Hikvision cameras, which may allow unauthenticated attackers to cause device malfuncti (CVSS 7.7)
- [CVE-2026-57600](https://cve.now/CVE-2026-57600.md): Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthenticated attackers to retrieve partial s (CVSS 7.5)
- [CVE-2026-57599](https://cve.now/CVE-2026-57599.md): There is a privilege escalation vulnerability in some Hikvision cameras. (CVSS 6.6)
- [CVE-2026-32684](https://cve.now/CVE-2026-32684.md): The application does not impose strict enough restrictions on directory access permissions, posing a risk that other malicious applications (CVSS 2.9)
- [CVE-2026-3828](https://cve.now/CVE-2026-3828.md): Some Hikvision switch products (discontinued since December 2023) are vulnerable to authenticated remote command execution due to insufficie (CVSS 7.2)
- [CVE-2026-1749](https://cve.now/CVE-2026-1749.md): There is an Access Control Vulnerability in some HikCentral Professional versions. (CVSS 6.8)
- [CVE-2026-0709](https://cve.now/CVE-2026-0709.md): Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input validation. (CVSS 7.2)
- [CVE-2025-66177](https://cve.now/CVE-2025-66177.md): There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision NVR/DVR/CVR/IPC models. (CVSS 8.8)
- [CVE-2025-66176](https://cve.now/CVE-2025-66176.md): There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision Access Control Products. (CVSS 8.8)
- [CVE-2025-66174](https://cve.now/CVE-2025-66174.md): There is an improper authentication vulnerability in some Hikvision DVR products. (CVSS 6.5)
- [CVE-2025-66173](https://cve.now/CVE-2025-66173.md): There is a privilege escalation vulnerability in some Hikvision DVR products. (CVSS 6.2)
- [CVE-2024-58274](https://cve.now/CVE-2024-58274.md): Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2024-08-01 allows execution of a command within $( ) in / (CVSS 8.3)
- [CVE-2023-53691](https://cve.now/CVE-2023-53691.md): Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2023-06-25 allows file upload via /center/api/files direc (CVSS 8.3)
- [CVE-2023-28815](https://cve.now/CVE-2023-28815.md): Some versions of Hikvision's iSecure Center Product contain insufficient parameter validation, resulting in a command injection vulnerabilit (CVSS 9.8)
- [CVE-2023-28814](https://cve.now/CVE-2023-28814.md): Some versions of Hikvision's iSecure Center Product have an improper file upload control vulnerability. (CVSS 9.8)
- [CVE-2025-39247](https://cve.now/CVE-2025-39247.md): There is an Access Control Vulnerability in some HikCentral Professional versions. (CVSS 8.6)
- [CVE-2025-39246](https://cve.now/CVE-2025-39246.md): There is an Unquoted Service Path Vulnerability in some HikCentral FocSign versions. (CVSS 5.3)
- [CVE-2025-39245](https://cve.now/CVE-2025-39245.md): There is a CSV Injection Vulnerability in some HikCentral Master Lite versions. (CVSS 4.7)
- [CVE-2025-34067](https://cve.now/CVE-2025-34067.md): Hikvision Integrated Security Management Platform Remote Command Execution via applyCT Fastjson (CVSS 10.0)
- [CVE-2025-39240](https://cve.now/CVE-2025-39240.md): Some Hikvision Wireless Access Point are vulnerable to authenticated remote command execution due to insufficient input validation. (CVSS 7.2)
- [CVE-2024-47486](https://cve.now/CVE-2024-47486.md): There is an XSS vulnerability in some HikCentral Master Lite versions. (CVSS 2.1)
- [CVE-2024-47487](https://cve.now/CVE-2024-47487.md): There is a SQL injection vulnerability in some HikCentral Professional versions. (CVSS 7.2)
- [CVE-2024-47485](https://cve.now/CVE-2024-47485.md): There is a CSV injection vulnerability in some HikCentral Master Lite versions. (CVSS 5.5)
- [CVE-2024-29949](https://cve.now/CVE-2024-29949.md): There is a command injection vulnerability in some Hikvision NVRs. (CVSS 7.2)
- [CVE-2024-29948](https://cve.now/CVE-2024-29948.md): There is an out-of-bounds read vulnerability in some Hikvision NVRs. (CVSS 3.8)
- [CVE-2024-29947](https://cve.now/CVE-2024-29947.md): There is a NULL dereference pointer vulnerability in some Hikvision NVRs. (CVSS 2.7)
- [CVE-2024-25064](https://cve.now/CVE-2024-25064.md): Due to insufficient server-side validation, an attacker with login privileges could access certain resources that the attacker should not ha (CVSS 4.3)
- [CVE-2024-25063](https://cve.now/CVE-2024-25063.md): Due to insufficient server-side validation, a successful exploit of this vulnerability could allow an attacker to gain access to certain URL (CVSS 7.5)
- [CVE-2023-6895](https://cve.now/CVE-2023-6895.md): Hikvision Intercom Broadcasting System ping.php os command injection (CVSS 6.3)
- [CVE-2023-6894](https://cve.now/CVE-2023-6894.md): Hikvision Intercom Broadcasting System Log File system.html information disclosure (CVSS 4.3)
- [CVE-2023-6893](https://cve.now/CVE-2023-6893.md): Hikvision Intercom Broadcasting System exportrecord.php path traversal (CVSS 4.3)
- [CVE-2023-28813](https://cve.now/CVE-2023-28813.md): An attacker could exploit a vulnerability by sending crafted messages to computers installed with this plug-in to modify plug-in parameters, (CVSS 8.1)
- [CVE-2023-28812](https://cve.now/CVE-2023-28812.md): There is a buffer overflow vulnerability in a web browser plug-in could allow an attacker to exploit the vulnerability by sending crafted me (CVSS 9.1)
- [CVE-2023-28811](https://cve.now/CVE-2023-28811.md): There is a buffer overflow in the password recovery feature of Hikvision NVR/DVR models. (CVSS 7.4)
- [CVE-2023-28810](https://cve.now/CVE-2023-28810.md): Some access control/intercom products have unauthorized modification of device network configuration vulnerabilities. (CVSS 4.3)
- [CVE-2023-28809](https://cve.now/CVE-2023-28809.md): Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user su (CVSS 7.5)
- [CVE-2023-28808](https://cve.now/CVE-2023-28808.md): Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the admin permission. (CVSS 9.1)
- [CVE-2022-28173](https://cve.now/CVE-2022-28173.md): The web server of some Hikvision wireless bridge products have an access control vulnerability which can be used to obtain the admin permiss (CVSS 9.1)
- [CVE-2022-28172](https://cve.now/CVE-2022-28172.md): The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. (CVSS 6.5)
- [CVE-2022-28171](https://cve.now/CVE-2022-28171.md): The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. (CVSS 7.5)
- [CVE-2018-6414](https://cve.now/CVE-2018-6414.md): A buffer overflow vulnerability in the web server of some Hikvision IP Cameras allows an attacker to send a specially crafted message to aff (no CVSS)
- [CVE-2018-6413](https://cve.now/CVE-2018-6413.md): There is a buffer overflow in the Hikvision Camera DS-2CD9111-S of V4.1.2 build 160203 and before, and this vulnerability allows remote atta (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/hikvision
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.