EUVD-2026-47626
GHSA-739w-7wq3-9vff
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify reachable Hikvision camera
-
DeliveryCraft malformed packet
-
ExploitSend to vulnerable service
-
ExecutionOverflow heap buffer
-
PersistCorrupt device memory
-
ImpactCamera crash / malfunction (DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reachability to the affected Hikvision DS-2CD or DS-2DE camera's vulnerable packet-parsing service and the ability to send a specially crafted packet; per the CVSS vector no authentication (PR:N) and no user interaction (UI:N) are needed. The key limiting factor is high attack complexity (AC:H) - reliably triggering the heap overflow depends on device- and firmware-specific conditions the attacker cannot fully control, so exploitation is not a trivial single-shot action. Realistic risk is further bounded by network exposure: cameras isolated on segmented or non-routable networks are only reachable by an attacker who already has a foothold on that segment. |
| Impact | The signals are moderate and partly conflicting. The CVSS vector rates attack vector as network with no privileges and no user interaction (AV:N/PR:N/UI:N), a serious exposure profile for an internet- or LAN-reachable camera, but it also assigns high attack complexity (AC:H), meaning reliable exploitation depends on conditions the attacker does not fully control (heap grooming, firmware/timing specifics). The vector claims high integrity and availability impact (I:H/A:H) with low confidentiality (C:L), yet the plain-language description asserts only 'device malfunction' - i.e., availability loss - with no stated code execution; this gap between the scored integrity impact and the described DoS effect should be verified with the vendor before treating remote code execution as confirmed. There is no EPSS score, no KEV listing, and no evidence of a public POC in the provided data, so this is a credible-but-not-imminent issue: prioritize patching internet-exposed cameras, but it does not show the hallmarks of active mass exploitation. |
| Exploit ScenarioDerived | An attacker who can reach a vulnerable DS-2CD or DS-2DE camera over the network - for example an internet-exposed or LAN-adjacent device - sends a specially crafted packet to the affected service, overflowing a heap buffer and knocking the camera offline or into a reboot loop, disrupting surveillance coverage. Because attack complexity is high (AC:H), reliable exploitation likely requires tuning to the specific firmware; no public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Denial of service (with potential memory corruption) in select Hikvision network cameras - specifically the DS-2CD and DS-2DE series - lets remote unauthenticated attackers crash or destabilize a device by sending specially crafted packets that trigger a heap buffer overflow. The flaw carries a CVSS 7.7 (AV:N/PR:N) and, per the supplied CVSS vector, high integrity and availability impact, though the vendor advisory characterizes the primary observable effect as device malfunction. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
RemediationAI
Patch available per vendor advisory - apply the fixed firmware published by Hikvision for the affected DS-2CD and DS-2DE cameras as described at https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-some-hikvision-cameras/ (the exact patched firmware version is not specified in the provided data, so confirm the correct build for your model from that advisory). Until firmware can be updated, reduce exposure of the vulnerable network service: remove cameras from direct internet reachability and place them on an isolated VLAN, restrict management/streaming ports (e.g., HTTP/RTSP/SDK service ports) to trusted management hosts via firewall or ACL, and require VPN access for any remote administration. These network controls block the crafted-packet path from untrusted networks at the cost of remote-access convenience but do not remove the underlying overflow, so treat them as interim measures pending the firmware update.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected devices are IP surveillance cameras from Hikvision's DS-2CD (fixed/bullet/dome network cameras) and DS-2DE (PTZ speed dome) product lines, identified by the CPE strings cpe:2.3:a:hikvision:ds-2cd_series and cpe:2.3:a:hikvision:ds-2de_series. The root cause is a heap buffer overflow (CWE-122 class; CWE is listed as N/A in the source): a network-facing service on the camera parses an attacker-supplied packet without adequately validating its length or structure before copying it into a dynamically allocated (heap) buffer, corrupting adjacent heap metadata or objects. In embedded camera firmware such corruption typically manifests as a service crash or watchdog reboot, and depending on heap layout can in principle be steered toward controlled memory writes.
Know when Ds 2Cd Series gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
Unauthenticated network packet (AV:N/PR:N/UI:N) but heap-overflow reliability makes AC:H; vendor describes only malfunction, so A:H with I:L potential and no confidentiality loss.
Primary rating from Vendor (hikvision).
CVSS VectorVendor: hikvision
DescriptionCVE.org
There is a heap buffer overflow vulnerability in some Hikvision cameras, which may allow unauthenticated attackers to cause device malfunction by sending specially crafted packets.
Executive ViewAI
Hikvision DS-2CD and DS-2DE series network cameras contain a remote denial-of-service vulnerability (CVE-2026-61390, CVSS 7.7) exploitable by unauthenticated attackers to crash or destabilize devices. Organizations relying on these cameras for physical security monitoring face potential blind spots if devices are compromised, creating gaps in surveillance coverage. The attack requires no authentication or elevated privileges, making it accessible to any attacker with network connectivity.
Network segmentation restricting camera access to trusted management VLANs; disable unnecessary network services on affected devices; implement rate-limiting on camera management interfaces; deploy network-based intrusion detection to monitor for exploitation attempts; maintain redundant or offline recording systems to ensure surveillance availability; restrict administrative access to cameras to authorized personnel only.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
More in Ds 2Cd Series
View allInformation disclosure in the firmware of multiple Hikvision network camera families (DS-2CD, DS-2DE, DS-2DP, DS-2TD ser
Denial-of-service via stack-based buffer overflow affects Hikvision DS-2CD and DS-2DE series IP cameras, where an authen
Privilege escalation in Hikvision DS-2CD series IP cameras allows an SSH-authenticated attacker to gain full administrat
Unauthenticated remote information disclosure in Hikvision DS-2CD and DS-2DE series IP cameras exposes partial device me
Exploit-DB