Hikvision Hik-Connect App CVE-2026-32684

Exploitation requires: (1) the Hik-Connect App must be installed and have stored sensitive data in world-readable or group-readable directories on the device; (2) a second application (malicious or compromised) must be installed on the same device with sufficient permissions to read the Hik-Connect app's data directories-this depends on the mobile OS (Android or iOS) and the platform's permission model; (3) the device must be unlocked or the malicious app must have already been granted broad storage permissions; (4) the attacker must have prior knowledge of where Hik-Connect stores sensitive data. The vulnerability does NOT require network access, authentication to Hikvision services, user interaction (UI:N is confirmed in CVSS), or special device configuration. However, on modern Android and iOS systems with stricter app sandboxing, exploitation is limited by the OS-enforced permission model-apps cannot freely access each other's private storage unless the OS grants explicit cross-app data sharing permissions or the device is rooted/jailbroken. This OS-level sandboxing is the primary limiting factor that keeps AC:H (high complexity) and real-world risk low.

This vulnerability carries low real-world risk despite its presence in a widely-used application. The CVSS score of 2.9 (Low severity) aligns with the limited attack vector (AV:L) and high attack complexity (AC:H), which together indicate that exploitation requires prior local device access, the presence of a malicious application on the same device, and non-trivial technical steps to extract the sensitive data. The EPSS value is not provided, but given the local-only constraint and high complexity, exploitation probability is expected to be low. No KEV listing, no public POC, and no reports of active exploitation suggest this is a theoretical rather than practical security concern in current threat landscapes. However, for users who install untrusted third-party applications alongside Hik-Connect, the risk becomes material. The vulnerability is consistent with common mobile OS permission models where apps with appropriate OS permissions can access data in world-readable directories. The C:L (low confidentiality impact) reflects that only a subset of sensitive data is exposed, not complete compromise of the application or device.

An attacker develops a malicious application that mimics a legitimate utility (e.g., a system cleaner or file manager) and convinces a user to install it on their smartphone alongside Hik-Connect. Once installed with filesystem access, the malicious app reads Hik-Connect's configuration or cache directories, extracts stored authentication tokens, user credentials, or personal information (account details, camera access data), and exfiltrates the data to a remote server. The attacker can then use the stolen credentials to access the victim's Hik-Connect account, cameras, or other connected Hikvision devices.