CVE-2026-16843CWE-78command-injection

CVE-2026-16843

High · published July 31, 2026

CVSS v3.1
7.2
EPSS
1%
Percentile
59.9
In the wild
Unconfirmed
What it is

Some Hikvision Networking Products are vulnerable to authenticated command execution due to insufficient input validation. Attackers with valid credentials can exploit this flaw by sending crafted packets containing malicious commands to affected devices, leading to arbitrary command execution.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00920 · 59.9th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-07-31T15:17Z
References (1)
https://www.hikvision.com/en/support/cybersecurity/security-advisory/command-execution-vulnerability-in-some-wireless-ap-products/ · [email protected]
EPSS history
Timeline
  • 31 JUL 09:31Z
    Some Hikvision Networking Products are vulnerable to authenticated command execution due to insufficient input validation
    cvelistv5