CVE-2026-0709

Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input validation

High · published January 30, 2026

CVSS v3.1
7.2
EPSS
1%
Percentile
59.5
In the wild
Unconfirmed
What it is

⚡ Just a few crafted packets from an attacker can unleash chaos on your Hikvision Wireless Access Points! Think of it like a hotel guest who has a key card to their room but sneaks into the staff-only areas using that access — they could mess with the entire operation without anyone noticing! With valid credentials, an attacker can run arbitrary commands on the device, potentially giving them control over your network. This could lead to a complete takeover of the access point, exposing sensitive data and compromising network integrity. It's a cyber burglar breaking into the control room and having free rein!

Put simply

Think of it like a hotel guest who has a key card to their room but sneaks into the staff-only areas using that access — they could mess with the entire operation without anyone noticing! This vulnerability stems from insufficient input validation, allowing authenticated users to send specially crafted packets that execute malicious commands on the affected Hikvision devices.

What to do

With valid credentials, an attacker can run arbitrary commands on the device, potentially giving them control over your network. This could lead to a complete takeover of the access point, exposing sensitive data and compromising network integrity. It's a cyber burglar breaking into the control room and having free rein! To safeguard your network, ensure you update your devices with the latest firmware. Regularly audit user accounts to ensure only trusted individuals have access, and consider implementing strict input validation measures. Don't wait until it's too late! You've got this — follow these steps to secure your system and keep those digital burglars at bay! 🛡️

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00906 · 59.5th percentile
Published
2026-01-30T11:01Z
EPSS history
Timeline
  • 30 JAN 11:01Z
    Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input validation
    cvelistv5