HikCentral Professional CVE-2026-1749

The vulnerability requires network-level access to HikCentral Professional administrative interfaces (AV:N). No authentication is required from the attacker (PR:N, UI:N). The attack complexity is elevated (AC:H), indicating specific conditions are necessary - likely involving particular configuration states, timing-dependent operations, or system-specific knowledge not disclosed in the advisory. The exploit does not require user interaction. The vulnerability scope changes (S:C), potentially affecting managed systems beyond HikCentral itself. Exploitation is limited by: the requirement for network connectivity to the platform, non-trivial attack complexity suggesting the vulnerability is not trivially exploitable by automated scanning alone, and the undisclosed specific technical conditions required to trigger the access control bypass.

CVSS score of 6.8 (Medium-High) reflects high confidentiality impact (C:H) and scope change (S:C) despite moderate attack complexity (AC:H). However, attack complexity is non-trivial, reducing real-world exploitation likelihood compared to AC:L vulnerabilities. EPSS data is not provided, limiting probability estimation; no CISA KEV listing is indicated, suggesting limited evidence of active, widespread exploitation at the time of advisory publication. The lack of public exploit code further reduces immediate threat level, though the access control bypass to administrative privileges represents significant risk if exploited. Organizations running HikCentral Professional should treat this as moderately urgent rather than critical, prioritizing patching over emergency measures unless additional evidence of active exploitation emerges. The scope change (S:C) indicates potential lateral movement impact across managed security infrastructure.

An unauthenticated attacker on the network scans for publicly exposed or internally accessible HikCentral Professional instances. The attacker sends a specially crafted network request exploiting the access control flaw (specific craft details not disclosed in advisory); due to AC:H, this may require knowledge of the platform architecture or timing. Upon successful exploitation, the attacker gains administrative credentials or session tokens, enabling full control of the security system including viewing camera feeds, modifying access policies, and managing user accounts across the monitored infrastructure.