Hikvision Cameras EUVD-2026-47625

The camera's web/management service must be reachable by the attacker over the network (AV:N), which in practice means the device is internet-exposed or the attacker is on the same reachable network segment. Per the CVSS vector (PR:N/UI:N/AC:L), exploitation requires no authentication, no user interaction, and no special configuration - it targets the affected firmware's parameter-handling on default-reachable interfaces of DS-2CD, DS-2DE, DS-2DP, and DS-2TD series cameras. The main limiting factors are network reachability (devices behind NAT/VPN with no inbound exposure are not remotely reachable) and running an affected firmware build on one of the four listed model families; the impact is also self-limited to disclosure of 'partial' sensitive data, not full compromise.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, 7.5) signals a low-effort, network-reachable, unauthenticated attack with high confidentiality impact and no integrity or availability effect. However, the description qualifies the disclosure as 'partial sensitive data,' which is more consistent with a limited (C:L) rather than total (C:H) confidentiality loss - this is a notable tension between the vendor's high rating and the described impact, and defenders should treat the true exposure as somewhere between the two. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so exploitation probability and automatability cannot be quantified from the input; the risk here is driven by the ease of access (no auth, low complexity) and the very large, often internet-facing install base rather than by any confirmed exploitation. Overall this is a credible real-world exposure worth prioritizing for internet-exposed devices, but it is a data-leak issue, not a device-takeover or RCE.

An attacker scans the internet for exposed Hikvision camera web interfaces and, without any credentials, sends a crafted request in which a specific input parameter is manipulated to bypass validation, causing the firmware to return partial sensitive information (e.g., configuration or device data). Given AV:N/AC:L/PR:N, the request can be issued directly over the network with no authentication or user interaction; no public exploit code has been identified, so this reflects the described capability rather than a confirmed in-the-wild technique.