What is the CVSS score of CVE-2026-61390?

CVE-2026-61390 has a CVSS 3.1 base score of 7.7 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Hikvision Cameras are affected by CVE-2026-61390?

Hikvision DS-2CD and DS-2DE series network cameras contain a remote denial-of-service vulnerability (CVE-2026-61390, CVSS 7.7) exploitable by unauthenticated attackers to crash or destabilize…

How to fix or mitigate CVE-2026-61390?

Within 24 hours, complete an inventory of all Hikvision DS-2CD and DS-2DE series cameras in your environment and assess their network exposure and criticality. Within 7 days, implement network segmentation to restrict camera access to authorized management networks only, deploy rate-limiting controls on camera interfaces, and enable detailed logging to detect anomalous traffic. Within 30 days, establish continuous monitoring of Hikvision security advisories for patch availability, maintain offline or alternative recording systems to ensure surveillance continuity during potential device compromises, and evaluate vendor alternatives if patches remain unavailable.

Hikvision Cameras CVE-2026-61390

EUVD-2026-47626 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-07-22 hikvision

GHSA-739w-7wq3-9vff

Buffer Overflow Hikvision Ds 2Cd Series Ds 2De Series Heap Overflow

7.7

CVSS 3.1 · Vendor: hikvision

Severity by source

Vendor (hikvision) PRIMARY

7.7 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H

vuln.today AI

6.5 MEDIUM

Unauthenticated network packet (AV:N/PR:N/UI:N) but heap-overflow reliability makes AC:H; vendor describes only malfunction, so A:H with I:L potential and no confidentiality loss.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hikvision).

CVSS VectorVendor: hikvision

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 12:27 vuln.today

CVE Published

Jul 22, 2026 - 11:02 cve.org

HIGH 7.7

DescriptionCVE.org

There is a heap buffer overflow vulnerability in some Hikvision cameras, which may allow unauthenticated attackers to cause device malfunction by sending specially crafted packets.

AnalysisAI

Denial of service (with potential memory corruption) in select Hikvision network cameras - specifically the DS-2CD and DS-2DE series - lets remote unauthenticated attackers crash or destabilize a device by sending specially crafted packets that trigger a heap buffer overflow. The flaw carries a CVSS 7.7 (AV:N/PR:N) and, per the supplied CVSS vector, high integrity and availability impact, though the vendor advisory characterizes the primary observable effect as device malfunction. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

The affected devices are IP surveillance cameras from Hikvision's DS-2CD (fixed/bullet/dome network cameras) and DS-2DE (PTZ speed dome) product lines, identified by the CPE strings cpe:2.3:a:hikvision:ds-2cd_series and cpe:2.3:a:hikvision:ds-2de_series. The root cause is a heap buffer overflow (CWE-122 class; CWE is listed as N/A in the source): a network-facing service on the camera parses an attacker-supplied packet without adequately validating its length or structure before copying it into a dynamically allocated (heap) buffer, corrupting adjacent heap metadata or objects. In embedded camera firmware such corruption typically manifests as a service crash or watchdog reboot, and depending on heap layout can in principle be steered toward controlled memory writes.

RemediationAI

Patch available per vendor advisory - apply the fixed firmware published by Hikvision for the affected DS-2CD and DS-2DE cameras as described at https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-some-hikvision-cameras/ (the exact patched firmware version is not specified in the provided data, so confirm the correct build for your model from that advisory). Until firmware can be updated, reduce exposure of the vulnerable network service: remove cameras from direct internet reachability and place them on an isolated VLAN, restrict management/streaming ports (e.g., HTTP/RTSP/SDK service ports) to trusted management hosts via firewall or ACL, and require VPN access for any remote administration. These network controls block the crafted-packet path from untrusted networks at the cost of remote-access convenience but do not remove the underlying overflow, so treat them as interim measures pending the firmware update.