Hikvision Intercom CVE-2026-85544

Physical proximity (under approximately 10 cm NFC range) to either a legitimate M1 card in transit or to the intercom card reader is required - there is no network exposure. No authentication, account, or prior system access is needed. The vulnerability is conditional on the deployment using MIFARE Classic M1 cards for access control; facilities that have already migrated to DESFire or SEOS credentials are not affected at the cryptographic layer. All listed firmware versions up to and including their respective maximums are vulnerable. Exploitation is further bounded by physical security controls around the reader itself: tamper-resistant recessed mounts or vestibule access controls limit opportunistic card skimming.

The physical access vector (AV:P) is the dominant risk-limiting factor: an attacker must be within NFC read range (typically under 10 cm) of either a legitimate card or the reader itself. This substantially constrains opportunistic internet-scale exploitation and makes automated mass attacks impossible. That said, MIFARE Classic weaknesses are well-understood and exploit tooling is trivially accessible, so AC:L is accurate - the cryptographic barrier is effectively nonexistent once physical proximity is achieved. The high confidentiality impact (C:H) reflects sector key extraction, and the low integrity impact (I:L) reflects card cloning; however, from a physical security standpoint, a forged card grants unauthorized building access, making the real-world impact on premises security considerably higher than a CVSS base score of 5.2 suggests. Even a mid-sized municipal IT team in leszno responsible for access control at city facilities should treat firmware updates on these panels as a priority given how low the bar is for card cloning once an attacker intercepts a legitimate card in an elevator or lobby. No EPSS data or KEV listing is available. No public exploit specific to these Hikvision models is identified at time of analysis, though generic MIFARE Classic attack frameworks constitute functional primitives.

An attacker loitering near a building entrance equipped with a Hikvision DS-KV or DS-KD panel uses a concealed Proxmark3 device to skim the M1 card of an employee who presents it to enter, extracting the Crypto-1 sector keys within seconds via a nested authentication attack. The attacker then writes a cloned credential to a blank MIFARE Classic card and returns to present it to the reader, gaining authenticated physical access without alerting staff. No public exploit specific to Hikvision's implementation exists, but the underlying MIFARE Classic attack chain requires only commodity hardware costing under $100.