Hikvision

Exploited now

CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.

• 9.8CriticalMar 5, 2026Hikvision Multiple Products Auth bypass / access controlCVE-2017-7921Multiple Hikvision products contain an improper authentication vulnerability that could allow a malicious user to escalate privileges on the system and gain access to sensitive information.Added to KEV Mar 5, 2026Exploited100% likelyExploit codeMetasploit · NucleiDetection
• 9.8CriticalSep 22, 2021Hikvision Security cameras web server Code / command injectionCVE-2021-36260A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation.Added to KEV Jan 10, 2022 · 109 days after publicationExploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection

Recent

• 7.1HighSep 10, 2026Hikvision HikCentral Access Control Auth bypass / access controlCVE-2026-85545There is an Vulnerability in some HikCentral Access Control versions. Authenticated low-privilege users can invoke API interfaces that their role is not authorized to access.
• 6.1MediumSep 10, 2026Hikvision DS-KV9503 Auth bypass / access controlCVE-2026-85544Some Hikvision intercom products utilize an immutable factory value which should be obtained from local network or physical interaction with the device within their main card, which may allow attackers to forge a legitimate main card, thereby gaining the permission to issue cards.
• 4.3MediumSep 10, 2026Hikvision Wi-Fi series camera Auth bypass / access controlCVE-2026-85543Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, allowing authenticated low-privileged users to obtain device Wi-Fi configuration information through these interfaces.
• 9.8CriticalMar 5, 2026Hikvision Multiple Products Auth bypass / access controlCVE-2017-7921Multiple Hikvision products contain an improper authentication vulnerability that could allow a malicious user to escalate privileges on the system and gain access to sensitive information.Exploited100% likelyExploit codeMetasploit · NucleiDetection
• 8.8HighJan 13, 2026Hikvision ds-k1t331 firmware Memory corruptionCVE-2025-66176There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision Access Control Products. If exploited, an attacker on the same local area network (LAN) could cause the device to malfunction by sending specially crafted packets to an unpatched device.
• 6.5MediumDec 19, 2025Hikvision ds-7104hghi-f1 firmware Auth bypass / access controlCVE-2025-66174There is an improper authentication vulnerability in some Hikvision DVR products. Due to the improper implementation of authentication for the serial port, an attacker with physical access could exploit this vulnerability by connecting to the affected products and run a series of commands.
• 6.2MediumDec 19, 2025Hikvision ds-7104hghi-f1 firmware Privilege escalationCVE-2025-66173There is a privilege escalation vulnerability in some Hikvision DVR products. Due to the improper implementation of authentication for the serial port, an attacker with physical access could exploit this vulnerability by connecting to the affected products and gaining access to an unrestricted shell environment.
• 9.8CriticalSep 22, 2021Hikvision Security cameras web server Code / command injectionCVE-2021-36260A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation.Exploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection

See every Hikvision entry on the dashboard.

Top products

• ds-7104hghi-f1 firmware2 CVEs in the last year
• Wi-Fi series camera1 CVE in the last year
• Multiple Products1 CVE in the last year, 1 critical, 1 exploited
• HikCentral Access Control1 CVE in the last year
• DS-KV95031 CVE in the last year
• ds-k1t331 firmware1 CVE in the last year