HikCentral Access Control EUVD-2026-75401

Exploitation requires a valid authenticated session with at least a low-privilege account on the HikCentral Access Control platform (PR:L per CVSS). The platform must be network-reachable (AV:N), which in most deployments means it is accessible via a corporate LAN or management network. No special configuration, non-default settings, or user interaction is needed beyond holding valid credentials. Exploitation is limited by the requirement for at least a basic account - unauthenticated access is not indicated by the CVSS vector (PR:L, not PR:N). Organizations that restrict low-privilege account creation and enforce network segmentation on the HikCentral management interface substantially reduce realistic exposure.

The CVSS 7.1 score (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) is well-calibrated for this vulnerability. Attack complexity is low with no user interaction required - once an attacker holds any valid low-privilege credential, exploitation is a straightforward matter of crafting API requests to unauthorized endpoints. The high confidentiality impact (C:H) is the dominant concern: a physical access control system holds sensitive data including personnel schedules, door access logs, cardholder credentials, and facility layout. The low integrity impact (I:L) suggests limited but non-trivial write capability through the unauthorized API surface. No public exploit code or active exploitation is identified; the EPSS signal is not provided in source data. The primary realistic threat is malicious insiders or attackers who have compromised a low-privilege service or operator account. Because this is an enterprise physical security platform rather than a consumer product, the realistic attacker pool is constrained - but the sensitivity of data (physical access patterns, personnel movements) elevates the real-world impact. The absence of a scope change (S:U) correctly reflects that exploitation is bounded to the HikCentral system itself.

An attacker who has obtained a low-privilege HikCentral operator account - either through credential theft, phishing, or insider access - directly sends HTTP API requests to administrative endpoints (such as user management, access rule configuration, or audit log retrieval) that their role should not permit. Because role enforcement is absent or incomplete at the API layer, the server processes the requests and returns restricted data or executes privileged operations. No public exploit code is identified, but the attack requires only knowledge of the API endpoint paths, which may be discoverable via documentation or API enumeration.