EUVD-2026-47624
GHSA-xfrr-5gjq-c74j
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
SSH authentication requires network credentials (PR:L), high complexity reflects non-trivial privilege escalation technique; full post-exploitation impact but no scope change.
Primary rating from Vendor (hikvision).
CVSS VectorVendor: hikvision
Lifecycle Timeline
2DescriptionCVE.org
There is a privilege escalation vulnerability in some Hikvision cameras. Due to incorrect permission allocation in the device program, attackers can escalate privileges and gain full control of the device after authenticating via SSH.
AnalysisAI
Privilege escalation in Hikvision DS-2CD series IP cameras allows an SSH-authenticated attacker to gain full administrative control of the device by exploiting incorrect permission allocation in the device firmware. The vulnerability requires prior SSH authentication, making it an insider or credential-theft-dependent threat rather than an unauthenticated remote attack. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but successful exploitation delivers complete confidentiality, integrity, and availability compromise of the affected camera.
Technical ContextAI
The affected products are Hikvision DS-2CD series IP cameras (CPE: cpe:2.3:a:hikvision:ds-2cd_series:*:*:*:*:*:*:*:*), a widely deployed line of network-connected surveillance cameras. The root cause is incorrect permission allocation in the on-device software - a category of misconfigured access control rather than a memory-safety or injection flaw. No CWE has been formally assigned by NVD or the vendor, but the behavior aligns with CWE-269 (Improper Privilege Management) or CWE-732 (Incorrect Permission Assignment for Critical Resource). The SSH daemon exposes a shell environment in which a lower-privileged authenticated user can exploit the misconfigured permission model to elevate to a higher-privileged context - likely root or a supervisory process - and subsequently gain full device control.
RemediationAI
The primary remediation is to apply the patched firmware released by Hikvision. Specific fixed firmware version numbers are not confirmed in the available data - administrators must consult the official advisory at https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-some-hikvision-cameras/ to identify the exact update target for their model. Until patching is possible, restrict SSH access to these cameras using network-level controls: place cameras on an isolated VLAN or management network reachable only from trusted administrative hosts, and apply firewall or ACL rules to block SSH (TCP/22) from general corporate or internet-facing networks. Rotate all SSH credentials for affected devices to limit the blast radius if credentials have been shared or compromised. Disable SSH entirely on cameras where remote shell access is not operationally required - most camera management functions are available via the web interface or ONVIF protocol and do not depend on SSH. Note that disabling SSH eliminates the attack surface entirely but removes the ability to perform low-level device diagnostics.
More in Ds 2Cd Series
View allDenial of service (with potential memory corruption) in select Hikvision network cameras - specifically the DS-2CD and D
Information disclosure in the firmware of multiple Hikvision network camera families (DS-2CD, DS-2DE, DS-2DP, DS-2TD ser
Denial-of-service via stack-based buffer overflow affects Hikvision DS-2CD and DS-2DE series IP cameras, where an authen
Unauthenticated remote information disclosure in Hikvision DS-2CD and DS-2DE series IP cameras exposes partial device me
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today