What is the CVSS score of CVE-2026-61391?

CVE-2026-61391 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Hikvision Cameras are affected by CVE-2026-61391?

Hikvision DS-2CD and DS-2DE series IP cameras are vulnerable to authenticated denial-of-service attacks that can corrupt device memory and potentially lead to unauthorized system access.

How to fix or mitigate CVE-2026-61391?

Within 24 hours, identify and catalog all affected Hikvision DS-2CD and DS-2DE cameras across your infrastructure and immediately restrict network access to trusted administrative networks only, disabling any direct internet-facing paths. Within 7 days, implement network segmentation by isolating camera systems on a dedicated VLAN with strict firewall policies limiting access to authorized administrators, and enable authentication logging to monitor for suspicious access attempts. Within 30 days, continuously monitor Hikvision security advisories for patch release information and request an estimated remediation timeline from the vendor; evaluate alternative or upgraded camera systems if the vendor cannot commit to a reasonable patch timeline.

Hikvision Cameras CVE-2026-61391

EUVD-2026-47627 HIGH

Stack-based Buffer Overflow (CWE-121)

2026-07-22 hikvision

GHSA-qv24-466w-wgvj

Buffer Overflow Stack Overflow Hikvision Ds 2Cd Series Ds 2De Series

7.2

CVSS 3.1 · Vendor: hikvision

Severity by source

Vendor (hikvision) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

4.9 MEDIUM

Description supports only authenticated (PR:H) network-triggered device malfunction, so A:H with C:N/I:N; vendor's C:H/I:H is unsupported by the stated DoS-only impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hikvision).

CVSS VectorVendor: hikvision

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 22, 2026 - 12:26 vuln.today

CVE Published

Jul 22, 2026 - 11:02 cve.org

HIGH 7.2

DescriptionCVE.org

There is a stack-based buffer overflow vulnerability in some Hikvision cameras, which may allow authenticated attackers to cause device malfunction by sending specially crafted packets.

AnalysisAI

Denial-of-service via stack-based buffer overflow affects Hikvision DS-2CD and DS-2DE series IP cameras, where an authenticated attacker sending specially crafted network packets can corrupt memory and force device malfunction. The vendor's CVSS vector claims full confidentiality and integrity impact (C:H/I:H) in addition to availability, hinting at possible code execution beyond the DoS described, though the advisory text only states device malfunction. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The affected devices are Hikvision network surveillance cameras - the DS-2CD series (fixed/box/bullet/turret IP cameras) and DS-2DE series (PTZ speed-dome cameras), per the CPE strings cpe:2.3:a:hikvision:ds-2cd_series and cpe:2.3:a:hikvision:ds-2de_series. The root cause is a stack-based buffer overflow (CWE-121, though the input lists CWE as N/A), a classic memory-safety defect in which attacker-controlled data in a network packet exceeds a fixed-size stack buffer, overwriting adjacent stack memory including saved return addresses. On embedded camera firmware this typically arises in a packet-parsing routine reachable over the network after authentication; overwriting the stack can crash the process (device malfunction) or, in the worst case, redirect execution, which may explain the vendor's high C/I ratings.

RemediationAI

Apply the firmware update published in Hikvision's security advisory at https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-some-hikvision-cameras/; no exact fixed firmware version is provided in the input data, so obtain the patched build for your specific DS-2CD/DS-2DE model from that advisory (Patch available per vendor advisory). Because exploitation requires an authenticated high-privileged account, immediately rotate and strengthen admin credentials and remove any default/shared accounts. As compensating controls until patching, place cameras on an isolated management VLAN and block their management/streaming ports (e.g., HTTP/HTTPS 80/443, RTSP 554, and the Hikvision SDK/service port 8000) from untrusted networks and the internet - the trade-off is that legitimate remote administration and third-party VMS integrations must be tunneled through a VPN. Restrict administrative access to a small set of trusted management hosts via ACLs to shrink the population of accounts that can reach the vulnerable parser.