CVE-2026-0709

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0709", "assignerOrgId": "da451dce-859b-4e51-8b87-9c8b60d19b32", "state": "PUBLISHED", "assignerShortName": "hikvision", "dateReserved": "2026-01-08T05:49:12.677Z", "datePublished": "2026-01-30T11:01:55.633Z", "dateUpdated": "2026-02-27T14:49:22.572Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input validation. Attackers with valid credentials can exploit this flaw by sending crafted packets containing malicious commands to affected devices, leading to arbitrary command execution."}], "affected": [{"vendor": "Hikvision", "product": "DS-3WAP521-SI", "versions": [{"version": "V1.1.6303 build250812 and earlier", "status": "affected"}]}, {"vendor": "Hikvision", "product": "DS-3WAP522-SI", "versions": [{"version": "V1.1.6303 build250812 and earlier", "status": "affected"}]}, {"vendor": "Hikvision", "product": "DS-3WAP621E-SI", "versions": [{"version": "V1.1.6303 build250812 and earlier", "status": "affected"}]}, {"vendor": "Hikvision", "product": "DS-3WAP622E-SI", "versions": [{"version": "V1.1.6303 build250812 and earlier", "status": "affected"}]}, {"vendor": "Hikvision", "product": "DS-3WAP623E-SI", "versions": [{"version": "V1.1.6303 build250812 and earlier", "status": "affected"}]}, {"vendor": "Hikvision", "product": "DS-3WAP622G-SI", "versions": [{"version": "V1.1.6303 build250812 and earlier", "status": "affected"}]}], "references": [{"url": "https://www.hikvision.com/en/support/cybersecurity/security-advisory/command-execution-vulnerability-in-some-hikvision-wireless-access-point-products/"}], "credits": [{"lang": "en", "value": "exzettabyte", "type": "finder"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}}], "providerMetadata": {"orgId": "da451dce-859b-4e51-8b87-9c8b60d19b32", "shortName": "hikvision", "dateUpdated": "2026-01-30T11:01:55.633Z"}, "x_generator": {"engine": "cveClient/1.0.15"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-78", "lang": "en", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-30T12:13:24.741883Z", "id": "CVE-2026-0709", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T14:49:22.572Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0709", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-30T12:13:24.741883Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-78", "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-30T12:13:52.114Z"}}], "cna": {"credits": [{"lang": "en", "type": "finder", "value": "exzettabyte"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Hikvision", "product": "DS-3WAP521-SI", "versions": [{"status": "affected", "version": "V1.1.6303 build250812 and earlier"}]}, {"vendor": "Hikvision", "product": "DS-3WAP522-SI", "versions": [{"status": "affected", "version": "V1.1.6303 build250812 and earlier"}]}, {"vendor": "Hikvision", "product": "DS-3WAP621E-SI", "versions": [{"status": "affected", "version": "V1.1.6303 build250812 and earlier"}]}, {"vendor": "Hikvision", "product": "DS-3WAP622E-SI", "versions": [{"status": "affected", "version": "V1.1.6303 build250812 and earlier"}]}, {"vendor": "Hikvision", "product": "DS-3WAP623E-SI", "versions": [{"status": "affected", "version": "V1.1.6303 build250812 and earlier"}]}, {"vendor": "Hikvision", "product": "DS-3WAP622G-SI", "versions": [{"status": "affected", "version": "V1.1.6303 build250812 and earlier"}]}], "references": [{"url": "https://www.hikvision.com/en/support/cybersecurity/security-advisory/command-execution-vulnerability-in-some-hikvision-wireless-access-point-products/"}], "x_generator": {"engine": "cveClient/1.0.15"}, "descriptions": [{"lang": "en", "value": "Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input validation. Attackers with valid credentials can exploit this flaw by sending crafted packets containing malicious commands to affected devices, leading to arbitrary command execution."}], "providerMetadata": {"orgId": "da451dce-859b-4e51-8b87-9c8b60d19b32", "shortName": "hikvision", "dateUpdated": "2026-01-30T11:01:55.633Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0709", "state": "PUBLISHED", "dateUpdated": "2026-02-27T14:49:22.572Z", "dateReserved": "2026-01-08T05:49:12.677Z", "assignerOrgId": "da451dce-859b-4e51-8b87-9c8b60d19b32", "datePublished": "2026-01-30T11:01:55.633Z", "assignerShortName": "hikvision"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "DS-3WAP521-SI", "vendor": "Hikvision", "versions": [{"status": "affected", "version": "V1.1.6303 build250812 and earlier"}]}, {"product": "DS-3WAP522-SI", "vendor": "Hikvision", "versions": [{"status": "affected", "version": "V1.1.6303 build250812 and earlier"}]}, {"product": "DS-3WAP621E-SI", "vendor": "Hikvision", "versions": [{"status": "affected", "version": "V1.1.6303 build250812 and earlier"}]}, {"product": "DS-3WAP622E-SI", "vendor": "Hikvision", "versions": [{"status": "affected", "version": "V1.1.6303 build250812 and earlier"}]}, {"product": "DS-3WAP623E-SI", "vendor": "Hikvision", "versions": [{"status": "affected", "version": "V1.1.6303 build250812 and earlier"}]}, {"product": "DS-3WAP622G-SI", "vendor": "Hikvision", "versions": [{"status": "affected", "version": "V1.1.6303 build250812 and earlier"}]}], "source": "hsrc@hikvision.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input validation. Attackers with valid credentials can exploit this flaw by sending crafted packets containing malicious commands to affected devices, leading to arbitrary command execution."}, {"lang": "es", "value": "Algunos Puntos de Acceso Inal\u00e1mbricos Hikvision son vulnerables a la ejecuci\u00f3n de comandos autenticada debido a una validaci\u00f3n de entrada insuficiente. Atacantes con credenciales v\u00e1lidas pueden exploit esta falla enviando paquetes manipulados que contienen comandos maliciosos a los dispositivos afectados, lo que lleva a la ejecuci\u00f3n arbitraria de comandos."}], "id": "CVE-2026-0709", "lastModified": "2026-06-17T10:11:14.787", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "hsrc@hikvision.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0709", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-30T12:13:24.741883Z", "version": "2.0.3"}}]}, "published": "2026-01-30T11:15:55.530", "references": [{"source": "hsrc@hikvision.com", "url": "https://www.hikvision.com/en/support/cybersecurity/security-advisory/command-execution-vulnerability-in-some-hikvision-wireless-access-point-products/"}], "sourceIdentifier": "hsrc@hikvision.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T14:29:31.560253+00:00", "value": {"mitigation_remediation": ["Update the device firmware to the latest version provided by Hikvision that resolves the input validation issue.", "If a patch is not available, block or restrict traffic to the device\u2019s management protocols from untrusted networks and limit the use of the exposed services to only those necessary for operation.", "Enforce strong, unique credentials for all user accounts and disable the default accounts left enabled on the device."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "Hikvision models DS\u20113WAP521\u2011SI, DS\u20113WAP522\u2011SI, DS\u20113WAP621E\u2011SI, DS\u20113WAP622E\u2011SI, DS\u20113WAP622G\u2011SI, and DS\u20113WAP623E\u2011SI are known to be affected. The vulnerability applies to firmware versions that have not yet been patched by Hikvision as described in their cybersecurity advisory.", "description_and_impact": "Some Hikvision Wireless Access Points allow attackers who possess valid credentials to send specially crafted packets that include malicious commands. The insufficient validation of input data enables arbitrary command execution on the affected devices, potentially giving attackers full control over the device functions and networks they manage. This flaw can be exercised as a command injection vulnerability, classified as CWE\u201178, allowing a remote authenticated attacker to execute any commands supported by the device operating system.", "risk_and_exploitability": "The CVSS score of 7.2 highlights a high severity risk, while the EPSS score of less than 1% indicates a very low probability of exploitation in the wild at present. The vulnerability is not listed in CISA\u2019s KEV catalog, which suggests that it is not tied to an active, publicly known exploit. However, because the flaw requires authentication, any compromised account or weak default credential could provide an attacker immediate local or remote control, depending on network configuration. The attack vector is likely restricted to an authenticated user; an attacker who can gain legitimate access to the device\u2019s management interface can trigger the vulnerability simply by sending crafted network packets."}}}}, "created": "2026-02-02T09:27:57.815967+00:00", "title": "Authenticated Command Execution in Hikvision Wireless Access Points", "updated": "2026-04-18T14:30:02.949270+00:00", "vendors": ["hikvision", "hikvision$PRODUCT$ds-3wap521-si", "hikvision$PRODUCT$ds-3wap522-si", "hikvision$PRODUCT$ds-3wap621e-si", "hikvision$PRODUCT$ds-3wap622e-si", "hikvision$PRODUCT$ds-3wap622g-si", "hikvision$PRODUCT$ds-3wap623e-si"]}