Hikvision
48 CVEs across 1132 Hikvision products. Browse Hikvision vulnerabilities, severities, and proof-of-concept exploits.
Hikvision products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-16843 | High | 7.2 | 2026-07-31 | Some Hikvision Networking Products are vulnerable to authenticated command execution due to insufficient input validation. Attackers with valid credentials can… |
CVE-2026-61392 | Medium | 5.3 | 2026-07-22 | There is a information disclosure vulnerability in some Hikvision cameras, allowing unauthenticated attackers to obtain partial information from the device’s m… |
CVE-2026-61391 | High | 7.2 | 2026-07-22 | There is a stack-based buffer overflow vulnerability in some Hikvision cameras, which may allow authenticated attackers to cause device malfunction by sending… |
CVE-2026-61390 | High | 7.7 | 2026-07-22 | There is a heap buffer overflow vulnerability in some Hikvision cameras, which may allow unauthenticated attackers to cause device malfunction by sending speci… |
CVE-2026-57600 | High | 7.5 | 2026-07-22 | Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthenticated attackers to retrieve partial sensitive data. |
CVE-2026-57599 | Medium | 6.6 | 2026-07-22 | There is a privilege escalation vulnerability in some Hikvision cameras. Due to incorrect permission allocation in the device program, attackers can escalate p… |
CVE-2026-32684 | Low | 2.9 | 2026-05-12 | The application does not impose strict enough restrictions on directory access permissions, posing a risk that other malicious applications could obtain sensit… |
CVE-2026-3828 | High | 7.2 | 2026-05-09 | Some Hikvision switch products (discontinued since December 2023) are vulnerable to authenticated remote command execution due to insufficient input validation… |
CVE-2026-1749 | Medium | 6.8 | 2026-05-09 | There is an Access Control Vulnerability in some HikCentral Professional versions. This could allow an unauthenticated user to obtain the admin permission. |
CVE-2026-0709 | High | 7.2 | 2026-01-30 | Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input validation. Attackers with valid credentials… |
CVE-2025-66177 | High | 8.8 | 2026-01-13 | There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision NVR/DVR/CVR/IPC models. If exploited, an attacker on the same… |
CVE-2025-66176 | High | 8.8 | 2026-01-13 | There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision Access Control Products. If exploited, an attacker on the same… |
CVE-2025-66174 | Medium | 6.5 | 2025-12-19 | There is an improper authentication vulnerability in some Hikvision DVR products. Due to the improper implementation of authentication for the serial port, an… |
CVE-2025-66173 | Medium | 6.2 | 2025-12-19 | There is a privilege escalation vulnerability in some Hikvision DVR products. Due to the improper implementation of authentication for the serial port, an atta… |
CVE-2024-58274 | High | 8.3 | 2025-10-22 | Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2024-08-01 allows execution of a command within $( ) in /center/api/installa… |
CVE-2023-53691 | High | 8.3 | 2025-10-22 | Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2023-06-25 allows file upload via /center/api/files directory traversal, as… |
CVE-2023-28815 | Critical | 9.8 | 2025-10-17 | Some versions of Hikvision's iSecure Center Product contain insufficient parameter validation, resulting in a command injection vulnerability. Attackers may ex… |
CVE-2023-28814 | Critical | 9.8 | 2025-10-17 | Some versions of Hikvision's iSecure Center Product have an improper file upload control vulnerability. Due to the improper verification of file to be uploaded… |
CVE-2025-39247 | High | 8.6 | 2025-08-29 | There is an Access Control Vulnerability in some HikCentral Professional versions. This could allow an unauthenticated user to obtain the admin permission. |
CVE-2025-39246 | Medium | 5.3 | 2025-08-29 | There is an Unquoted Service Path Vulnerability in some HikCentral FocSign versions. This could allow an authenticated user to potentially enable escalation of… |
CVE-2025-39245 | Medium | 4.7 | 2025-08-29 | There is a CSV Injection Vulnerability in some HikCentral Master Lite versions. This could allow an attacker to inject executable commands via malicious CSV da… |
CVE-2025-34067 | | 2025-07-02 | An unauthenticated remote command execution vulnerability exists in the applyCT component of the Hikvision Integrated Security Management Platform due to the u… | |
CVE-2025-39240 | High | 7.2 | 2025-06-13 | Some Hikvision Wireless Access Point are vulnerable to authenticated remote command execution due to insufficient input validation. Attackers with valid creden… |
CVE-2024-47487 | High | 8.8 | 2024-10-18 | There is a SQL injection vulnerability in some HikCentral Professional versions. This could allow an authenticated user to execute arbitrary SQL queries. |
CVE-2024-47486 | Medium | 6.1 | 2024-10-18 | There is an XSS vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could inject scripts into certain pages by building malicious… |
CVE-2024-47485 | Critical | 9.8 | 2024-10-18 | There is a CSV injection vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could build malicious data to generate executable com… |
CVE-2023-33806 | High | 7.8 | 2024-04-15 | Insecure default configurations in Hikvision Interactive Tablet DS-D5B86RB/B V2.3.0 build220119, allows attackers to execute arbitrary commands. |
CVE-2024-29949 | High | 7.2 | 2024-04-02 | There is a command injection vulnerability in some Hikvision NVRs. This could allow an authenticated user with administrative rights to execute arbitrary comma… |
CVE-2024-29948 | Low | 3.8 | 2024-04-02 | There is an out-of-bounds read vulnerability in some Hikvision NVRs. An authenticated attacker could exploit this vulnerability by sending specially crafted me… |
CVE-2024-29947 | Low | 2.7 | 2024-04-02 | There is a NULL dereference pointer vulnerability in some Hikvision NVRs. Due to an insufficient validation of a parameter in a message, an attacker may send s… |
CVE-2024-25064 | Medium | 4.3 | 2024-03-02 | Due to insufficient server-side validation, an attacker with login privileges could access certain resources that the attacker should not have access to by cha… |
CVE-2024-25063 | High | 7.5 | 2024-03-02 | Due to insufficient server-side validation, a successful exploit of this vulnerability could allow an attacker to gain access to certain URLs that the attacker… |
CVE-2023-6895 | Medium | 6.3 | 2023-12-17 | A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK). It has been declared as critical. This vulnerability affects u… |
CVE-2023-6894 | Medium | 4.3 | 2023-12-17 | A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK). It has been classified as problematic. This affects an unknown… |
CVE-2023-6893 | Medium | 4.3 | 2023-12-17 | A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK) and classified as problematic. Affected by this issue is some u… |
CVE-2023-28813 | High | 8.1 | 2023-11-23 | An attacker could exploit a vulnerability by sending crafted messages to computers installed with this plug-in to modify plug-in parameters, which could cause… |
CVE-2023-28812 | Critical | 9.1 | 2023-11-23 | There is a buffer overflow vulnerability in a web browser plug-in could allow an attacker to exploit the vulnerability by sending crafted messages to computers… |
CVE-2023-28811 | High | 7.4 | 2023-11-23 | There is a buffer overflow in the password recovery feature of Hikvision NVR/DVR models. If exploited, an attacker on the same local area network (LAN) could c… |
CVE-2023-28810 | Medium | 4.3 | 2023-06-15 | Some access control/intercom products have unauthorized modification of device network configuration vulnerabilities. Attackers can modify device network confi… |
CVE-2023-28809 | High | 7.5 | 2023-06-15 | Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user successfully logs in… |
CVE-2023-28808 | Critical | 9.1 | 2023-04-11 | Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the admin permission. The attacker can expl… |
CVE-2022-28173 | Critical | 9.1 | 2022-12-19 | The web server of some Hikvision wireless bridge products have an access control vulnerability which can be used to obtain the admin permission. The attacker c… |
CVE-2022-28172 | Medium | 6.5 | 2022-06-27 | The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attac… |
CVE-2022-28171 | High | 7.5 | 2022-06-27 | The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attac… |
CVE-2021-36260 | Critical | 9.8 | 2021-09-22 | A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability… |
CVE-2020-7057 | Medium | 5.3 | 2020-01-14 | Hikvision DVR DS-7204HGHI-F1 V4.0.1 build 180903 Web Version sends a different response for failed ISAPI/Security/sessionLogin/capabilities login attempts depe… |
CVE-2013-4976 | Critical | 9.8 | 2019-12-27 | Hikvision DS-2CD7153-E IP Camera has security bypass via hardcoded credentials |
CVE-2013-4975 | High | 8.8 | 2019-12-27 | Hikvision DS-2CD7153-E IP Camera has Privilege Escalation |
CVE-2018-6414 | Critical | 9.8 | 2018-08-13 | A buffer overflow vulnerability in the web server of some Hikvision IP Cameras allows an attacker to send a specially crafted message to affected devices. Due… |
CVE-2018-6413 | High | 7.5 | 2018-04-18 | There is a buffer overflow in the Hikvision Camera DS-2CD9111-S of V4.1.2 build 160203 and before, and this vulnerability allows remote attackers to launch a d… |
CVE-2017-14953 | Medium | 6.5 | 2017-12-01 | HikVision Wi-Fi IP cameras, when used in a wired configuration, allow physically proximate attackers to trigger association with an arbitrary access point by l… |
CVE-2017-13774 | High | 7.8 | 2017-08-30 | Hikvision iVMS-4200 devices before v2.6.2.7 allow local users to generate password-recovery codes via unspecified vectors. |
CVE-2017-7923 | High | 8.8 | 2017-05-06 | A Password in Configuration File issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0… |
CVE-2017-7921 | Critical | 9.8 | 2017-05-06 | An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build… |
CVE-2015-4409 | Medium | 6.5 | 2017-03-13 | Buffer overflow on Hikvision NVR DS-76xxNI-E1/2 and DS-77xxxNI-E4 devices before 3.4.0 allows remote authenticated users to cause a denial of service (service… |
CVE-2015-4408 | Medium | 6.5 | 2017-03-13 | Buffer overflow on Hikvision NVR DS-76xxNI-E1/2 and DS-77xxxNI-E4 devices before 3.4.0 allows remote authenticated users to cause a denial of service (service… |
CVE-2015-4407 | Medium | 6.5 | 2017-03-13 | Buffer overflow on Hikvision NVR DS-76xxNI-E1/2 and DS-77xxxNI-E4 devices before 3.4.0 allows remote authenticated users to cause a denial of service (service… |
CVE-2014-4880 | | 2014-12-08 | Buffer overflow in Hikvision DVR DS-7204 Firmware 2.2.10 build 131009, and other models and versions, allows remote attackers to execute arbitrary code via an… | |
CVE-2013-4977 | | 2014-03-03 | Buffer overflow in the RTSP Packet Handler in Hikvision DS-2CD7153-E IP camera with firmware 4.1.0 b130111 (Jan 2013), and possibly other devices, allows remot… |