CVE-2026-85544CWE-1310CWE-798hardcoded-credentials

CVE-2026-85544

Medium · published September 10, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
34.2
In the wild
Unconfirmed
What it is

Some Hikvision intercom products utilize an immutable factory value which should be obtained from local network or physical interaction with the device within their main card, which may allow attackers to forge a legitimate main card, thereby gaining the permission to issue cards.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00411 · 34.2th percentile
Weaknesses
CWE-1310 · Missing Ability to Patch ROM Code; CWE-798 · Use of Hard-coded Credentials
Published
2026-09-10T17:20Z
References (1)
https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-some-hikvision-intercom-products · [email protected]
EPSS history
Timeline
  • 12 SEP 03:22Z
    EPSS moved — → 0%
    epss
  • 10 SEP 12:26Z
    There is an Improper Encryption Configuration Vulnerability in some Hikvision Intercom Products
    cvelistv5