Hikvision Cameras CVE-2026-61392

No special conditions - remote unauthenticated exploitation against default configurations of Hikvision DS-2CD and DS-2DE series cameras. The CVSS vector AV:N/AC:L/PR:N/UI:N/S:U confirms no authentication, no user interaction, and no elevated complexity are required. The primary limiting factor is network reachability: cameras must be accessible over the network (typical for their intended deployment). A secondary limiting factor is that only partial memory is disclosed per request (C:L), meaning the attacker may need multiple requests or specific knowledge of memory layout to extract actionable data. No specific feature flag, non-default configuration, or platform condition is identified in the available data as a prerequisite.

The CVSS 5.3 Medium score accurately reflects limited confidentiality impact (C:L) with no integrity or availability consequence. However, the AV:N/AC:L/PR:N/UI:N combination is particularly concerning for IoT surveillance devices: Hikvision cameras are routinely exposed on public IP addresses or poorly segmented networks, making the low attack complexity meaningful at scale. No EPSS data was provided, and no KEV listing or public POC is confirmed, so exploitation probability is currently unquantified. The self-disclosure by Hikvision suggests coordinated discovery rather than observed active exploitation. Real-world risk is elevated above the raw score if leaked memory contains credential material, but this is inferred from the nature of memory disclosures generally - the description does not confirm what categories of data are exposed. The primary limiting factor is that only partial memory is disclosed (C:L, S:U), reducing the likelihood of complete system compromise from this flaw alone.

An attacker with network access to an exposed Hikvision camera sends an unauthenticated HTTP request crafted to trigger the memory disclosure condition in the device firmware. The response returns partial contents of the camera's memory, which the attacker parses for sensitive data such as session tokens, passwords, or configuration fragments. No public POC is confirmed, but the low attack complexity (AC:L) and no-authentication requirement (PR:N) make this straightforward to exploit once the specific vulnerable request is identified.