EUVD-2026-75401
GHSA-4mg3-wwjr-979v
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
Network-accessible API, low-privilege credential required (PR:L), no interaction needed; high confidentiality and limited integrity impact match the authorization bypass scope.
Primary rating from Vendor (hikvision).
CVSS VectorVendor: hikvision
Lifecycle Timeline
2DescriptionCVE.org
There is an Vulnerability in some HikCentral Access Control versions. Authenticated low-privilege users can invoke API interfaces that their role is not authorized to access.
AnalysisAI
Improper authorization in Hikvision HikCentral Access Control V2.5.0 and below allows authenticated low-privilege users to invoke API endpoints restricted to higher-privileged roles, resulting in unauthorized access to sensitive data and limited system modification. The CVSS vector (PR:L, C:H, I:L) confirms the attacker requires only a valid low-privilege account but can achieve high confidentiality impact and limited integrity compromise across the network. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session with at least a low-privilege account on the HikCentral Access Control platform (PR:L per CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.1 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) is well-calibrated for this vulnerability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to upgrade HikCentral Access Control to a version above V2.5.0 per the Hikvision security advisory at https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-hikcentral-access-control. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Hikvision HikCentral Access Control deployments and identify systems running V2.5.0 or earlier; immediately restrict network access to HikCentral API endpoints through firewall rules segregating administrative access to named administrator IP ranges only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today