What is the CVSS score of CVE-2026-16843?

CVE-2026-16843 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.9%.

How to fix or mitigate CVE-2026-16843?

Within 24 hours, audit all affected Hikvision access points in inventory and conduct credential access review for administrative accounts, escalating any suspicious changes or unauthorized access attempts. Within 7 days, implement network segmentation isolating these devices from critical systems and production networks, disable remote web management interfaces where operationally feasible, and restrict administrative access using IP allowlisting to trusted administrators only. Within 30 days, establish a monitoring process for vendor security advisories, document the exact firmware versions deployed, and prepare a documented upgrade procedure so patches can be deployed rapidly when released; concurrently evaluate whether business operations can tolerate temporary device isolation or replacement as an alternative mitigation strategy.

Hikvision Wireless AP CVE-2026-16843

EUVD-2026-51516 HIGH

OS Command Injection (CWE-78)

2026-07-31 hikvision

GHSA-9f46-w698-g5q9

Command Injection Hikvision Ds 3Wap521 Si Ds 3Wap522 Si Ds 3Wap621E Si Ds 3Wap622E Si Ds 3Wap623E Si Ds 3Wap622G Si

7.2

CVSS 3.1 · Vendor: hikvision

Severity by source

Vendor (hikvision) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.2 HIGH

Network-delivered crafted packets (AV:N/AC:L) but valid high-privilege admin credentials required (PR:H); arbitrary command execution yields full C/I/A impact on the unchanged device scope.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hikvision).

CVSS VectorVendor: hikvision

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 10:52 vuln.today

CVE Published

Jul 31, 2026 - 09:31 cve.org

HIGH 7.2

DescriptionCVE.org

Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input validation. Attackers with valid credentials can exploit this flaw by sending crafted packets containing malicious commands to affected devices, leading to arbitrary command execution.

AnalysisAI

Authenticated command execution affects several Hikvision wireless access points (DS-3WAP521-SI, DS-3WAP522-SI, DS-3WAP621E-SI, DS-3WAP622E-SI, DS-3WAP623E-SI, DS-3WAP622G-SI), where insufficient input validation lets an attacker holding valid device credentials send crafted packets carrying malicious commands to achieve arbitrary command execution on the device. The CVSS 3.1 vector (7.2, AV:N/AC:L/PR:H/UI:N) indicates a network-reachable but high-privilege (authenticated) attack with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; the vendor has published a security advisory.

Technical ContextAI

The affected devices are Hikvision enterprise/SMB Wi-Fi access points in the DS-3WAP5xx/6xx-SI product family, embedded network appliances running a proprietary management firmware that accepts administrative/control packets over the network. The root cause is insufficient input validation on data contained in these crafted packets: attacker-supplied content is passed into an underlying command or shell context without adequate sanitization, permitting OS command injection (CWE-78-class behavior, although the input lists CWE as N/A). Because access points typically run their management services as a privileged system account, injected commands execute with elevated rights on the embedded OS. The CPE set precisely scopes the affected models to six application-level Hikvision AP identifiers, but no firmware version boundaries are provided in the CPE strings.

RemediationAI

Patch available per vendor advisory: apply the firmware update referenced in Hikvision's security advisory (https://www.hikvision.com/en/support/cybersecurity/security-advisory/command-execution-vulnerability-in-some-wireless-ap-products/) for each affected model; an exact fixed firmware version is not stated in the provided data, so confirm the correct build for your specific model directly from that advisory. Until patched, reduce exposure by restricting management access: place the AP management interface on an isolated management VLAN and block administrative access from user/guest and untrusted networks (trade-off: legitimate remote administration must then originate from that trusted segment), ensure the AP is never reachable from the internet, and rotate all administrative credentials to strong unique passwords to counter the PR:H prerequisite (trade-off: none material beyond operational effort). Because exploitation requires valid credentials, tightly limiting who holds AP admin accounts and monitoring device management logs for anomalous command activity are effective compensating controls.