Hikvision Cameras CVE-2026-61391

Exploitation requires an authenticated session with high privileges (CVSS PR:H - effectively an administrative account on the camera) and network reachability to the vulnerable packet-handling service on a DS-2CD or DS-2DE series device; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The primary limiting factor is that the attacker must already hold privileged credentials, so the flaw is not exploitable by anonymous/unauthenticated actors against a default deployment. Exploitation is further limited to the specific affected camera models and firmware ('some Hikvision cameras'), and risk is greatly reduced where camera management interfaces are not exposed to untrusted networks.

The CVSS 3.1 base score is 7.2 (High) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, meaning network-reachable and low-complexity but requiring high privileges (an authenticated administrative-level account). That PR:H requirement is the dominant mitigating factor and materially lowers real-world risk versus an unauthenticated flaw. No EPSS score, no SSVC decision data, no KEV listing, and no POC were provided, so exploitation-probability signals are absent rather than low - treat the lack of data as unknown, not as safe. There is a notable internal conflict: the description characterizes impact only as 'device malfunction' (an availability/DoS outcome), yet the vendor vector asserts C:H/I:H/A:H; verify with Hikvision whether code execution or data exposure is actually achievable, because if impact is DoS-only the effective severity is lower than 7.2. Overall this is a moderate-priority patch item - meaningful for exposed camera fleets but gated behind privileged access.

An attacker who has obtained valid administrative credentials for an exposed Hikvision camera (for example through credential reuse, phishing, or a leaked default password) sends a specially crafted packet to a vulnerable parsing service over the network. The malformed packet overflows a stack buffer, crashing the camera and knocking it offline; given AC:L the payload is straightforward to reproduce once access is held. No public POC is currently known.