What is the CVSS score of CVE-2026-22623?

CVE-2026-22623 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of HIKSEMI NAS are affected by CVE-2026-22623?

Authenticated users of HIKSEMI NAS devices can execute arbitrary commands due to insufficient input validation, potentially allowing compromised accounts or insider threats to gain complete control…

How to fix or mitigate CVE-2026-22623?

Within 24 hours: Identify all HIKSEMI NAS devices in your environment and document which models/versions are affected. Within 7 days: Implement network segmentation to restrict NAS access to only authorized users and systems; enable audit logging for all NAS administrative activities. Within 30 days: Monitor vendor advisories for patch availability and establish a testing/deployment plan; consider alternative storage solutions if patch timelines are unacceptable.

HIKSEMI NAS CVE-2026-22623

HIGH

Command Injection (CWE-77)

2026-01-30 hsrc@hikvision.com

Command Injection RCE

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:00 vuln.today

CVE Published

Jan 30, 2026 - 11:15 nvd

HIGH 7.2

DescriptionCVE.org

Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can execute arbitrary commands on the device by crafting specific messages.

AnalysisAI

Authenticated command injection in HIKSEMI NAS devices allows privileged users to execute arbitrary commands through improper input validation on the device interface. Attackers with valid credentials can craft malicious messages to achieve unauthenticated code execution on affected systems. No patch is currently available for this vulnerability.

Technical ContextAI

Classified as CWE-77 (Command Injection). Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can execute arbitrary commands on the device by crafting specific messages.

Affected ProductsAI

Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can execute arbitrary commands on