Hikvision vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited Hikvision flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2017-7921 Hikvision Multiple Products Improper AuthenticationExploited since Mar 5, 2026 · CVSS 9.8
• CVE-2021-36260 Hikvision Improper Input ValidationExploited since Jan 10, 2022 · CVSS 9.8

Latest high and critical flaws

• CVE-2026-85545 There is an Vulnerability in some HikCentral Access Control versions.High 7.1 · Sep 10, 2026
• CVE-2026-16843 Some Hikvision Networking Products are vulnerable to authenticated command execution due to insufficient input validation.High 7.2 · Jul 31, 2026
• CVE-2026-61391 There is a stack-based buffer overflow vulnerability in some Hikvision cameras, which may allow authenticated attackers to cause device malfunction by sending sHigh 7.2 · Jul 22, 2026
• CVE-2026-61390 There is a heap buffer overflow vulnerability in some Hikvision cameras, which may allow unauthenticated attackers to cause device malfunction by sending speciaHigh 7.7 · Jul 22, 2026
• CVE-2026-57600 Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthenticated attackers to retrieve partial sensitive data.High 7.5 · Jul 22, 2026
• CVE-2026-3828 Some Hikvision switch products (discontinued since December 2023) are vulnerable to authenticated remote command execution due to insufficient input validation.High 7.2 · May 9, 2026
• CVE-2026-0709 Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input validation.High 7.2 · Jan 30, 2026
• CVE-2025-66177 There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision NVR/DVR/CVR/IPC models.High 8.8 · Jan 12, 2026
• CVE-2025-66176 There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision Access Control Products.High 8.8 · Jan 12, 2026
• CVE-2024-58274 Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2024-08-01 allows execution of a command within $( ) in /center/api/installatHigh 8.3 · Oct 22, 2025
• CVE-2023-53691 Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2023-06-25 allows file upload via /center/api/files directory traversal, as eHigh 8.3 · Oct 22, 2025
• CVE-2023-28815 Some versions of Hikvision's iSecure Center Product contain insufficient parameter validation, resulting in a command injection vulnerability.Critical 9.8 · Oct 17, 2025
• CVE-2023-28814 Some versions of Hikvision's iSecure Center Product have an improper file upload control vulnerability.Critical 9.8 · Oct 17, 2025
• CVE-2025-39247 There is an Access Control Vulnerability in some HikCentral Professional versions.High 8.6 · Aug 28, 2025
• CVE-2025-34067 An unauthenticated remote command execution vulnerability exists in the applyCT component of the Hikvision Integrated Security Management Platform due to the usCritical 10 · Jul 2, 2025
• CVE-2025-39240 Some Hikvision Wireless Access Point are vulnerable to authenticated remote command execution due to insufficient input validation.High 7.2 · Jun 13, 2025
• CVE-2024-47487 There is a SQL injection vulnerability in some HikCentral Professional versions.High 7.2 · Oct 18, 2024
• CVE-2023-33806 Insecure default configurations in Hikvision Interactive Tablet DS-D5B86RB/B V2.3.0 build220119, allows attackers to execute arbitrary commands.High 7.8 · Apr 15, 2024
• CVE-2024-29949 There is a command injection vulnerability in some Hikvision NVRs.High 7.2 · Apr 2, 2024
• CVE-2024-25063 Due to insufficient server-side validation, a successful exploit of this vulnerability could allow an attacker to gain access to certain URLs that the attacker High 7.5 · Mar 1, 2024
• CVE-2023-28813 An attacker could exploit a vulnerability by sending crafted messages to computers installed with this plug-in to modify plug-in parameters, which could cause aHigh 8.1 · Nov 23, 2023
• CVE-2023-28812 There is a buffer overflow vulnerability in a web browser plug-in could allow an attacker to exploit the vulnerability by sending crafted messages to computers Critical 9.1 · Nov 23, 2023
• CVE-2023-28811 There is a buffer overflow in the password recovery feature of Hikvision NVR/DVR models.High 7.4 · Nov 23, 2023
• CVE-2023-28809 Some access control products are vulnerable to a session hijacking attack because the product does not update the session ID after a user successfully logs in.High 7.5 · Jun 15, 2023
• CVE-2023-28808 Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the admin permission.Critical 9.1 · Apr 11, 2023