CVE-2026-22623

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22623", "assignerOrgId": "da451dce-859b-4e51-8b87-9c8b60d19b32", "state": "PUBLISHED", "assignerShortName": "hikvision", "dateReserved": "2026-01-08T05:37:27.997Z", "datePublished": "2026-01-30T11:02:26.539Z", "dateUpdated": "2026-02-27T14:45:19.674Z"}, "containers": {"cna": {"descriptions": [{"lang": "en", "value": "Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can execute arbitrary commands on the device by crafting specific messages."}], "affected": [{"vendor": "HIKSEMI", "product": "HS-AFS-S1H1", "versions": [{"version": "V5.10.10_Build_251126", "status": "affected"}]}], "references": [{"url": "https://www.hiksemitech.com/en/hiksemi/support/security-advisory.html"}], "credits": [{"lang": "en", "value": "Jincheng Wang", "type": "finder"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}}], "providerMetadata": {"orgId": "da451dce-859b-4e51-8b87-9c8b60d19b32", "shortName": "hikvision", "dateUpdated": "2026-01-30T11:02:26.539Z"}, "x_generator": {"engine": "cveClient/1.0.15"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-77", "lang": "en", "description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-30T12:44:59.407089Z", "id": "CVE-2026-22623", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-27T14:45:19.674Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22623", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-30T12:44:59.407089Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-30T12:45:10.395Z"}}], "cna": {"credits": [{"lang": "en", "type": "finder", "value": "Jincheng Wang"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "HIKSEMI", "product": "HS-AFS-S1H1", "versions": [{"status": "affected", "version": "V5.10.10_Build_251126"}]}], "references": [{"url": "https://www.hiksemitech.com/en/hiksemi/support/security-advisory.html"}], "x_generator": {"engine": "cveClient/1.0.15"}, "descriptions": [{"lang": "en", "value": "Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can execute arbitrary commands on the device by crafting specific messages."}], "providerMetadata": {"orgId": "da451dce-859b-4e51-8b87-9c8b60d19b32", "shortName": "hikvision", "dateUpdated": "2026-01-30T11:02:26.539Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22623", "state": "PUBLISHED", "dateUpdated": "2026-02-27T14:45:19.674Z", "dateReserved": "2026-01-08T05:37:27.997Z", "assignerOrgId": "da451dce-859b-4e51-8b87-9c8b60d19b32", "datePublished": "2026-01-30T11:02:26.539Z", "assignerShortName": "hikvision"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "HS-AFS-S1H1", "vendor": "HIKSEMI", "versions": [{"status": "affected", "version": "V5.10.10_Build_251126"}]}], "source": "hsrc@hikvision.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can execute arbitrary commands on the device by crafting specific messages."}, {"lang": "es", "value": "Debido a la validaci\u00f3n insuficiente de par\u00e1metros de entrada en la interfaz, los usuarios autenticados de ciertos productos NAS de HIKSEMI pueden ejecutar comandos arbitrarios en el dispositivo mediante la creaci\u00f3n de mensajes espec\u00edficos."}], "id": "CVE-2026-22623", "lastModified": "2026-06-17T10:20:10.680", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "hsrc@hikvision.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22623", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-30T12:44:59.407089Z", "version": "2.0.3"}}]}, "published": "2026-01-30T11:15:55.663", "references": [{"source": "hsrc@hikvision.com", "url": "https://www.hiksemitech.com/en/hiksemi/support/security-advisory.html"}], "sourceIdentifier": "hsrc@hikvision.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T01:11:24.967761+00:00", "value": {"mitigation_remediation": ["Apply the latest firmware update released by HIKSEMI that contains the fix for this command injection flaw.", "Limit access to the NAS management interface to trusted internal networks or specific IP addresses, and disable external exposure whenever possible.", "Remove or disable any unused user accounts to reduce the number of potential authenticated entry points."], "summary": {"action": "Immediate Patch", "impact": "Arbitrary Command Execution"}, "threat_synthesis": {"affected_systems": "HIKSEMI NAS devices, specifically the HS\u2011AFS\u2011S1H1 model are affected. No specific firmware or software versions are listed, so the issue is presumed to exist across all supported releases of the affected product family.", "description_and_impact": "Insufficient validation of an input parameter on a network interface allows an authenticated user to send a crafted message that is executed as a command on the device. The flaw enables arbitrary command execution, effectively allowing an attacker to alter data, compromise confidentiality, or disrupt availability of the NAS system.", "risk_and_exploitability": "The vulnerability scores a 7.2 on the CVSS scale, indicating high severity, but the EPSS score is below 1%, suggesting a low likelihood of current exploitation. It has not been listed in the CISA KEV catalogue. Exploitation requires authentication to the device and the ability to send specially crafted interface messages, allowing an attacker with those privileges to achieve full device compromise."}}}}, "created": "2026-02-02T09:27:52.886380+00:00", "title": "Authenticated Command Injection Vulnerability in HIKSEMI NAS Interface", "updated": "2026-04-18T01:15:05.992548+00:00", "vendors": ["hiksemi", "hiksemi$PRODUCT$hs-afs-s1h1"]}