Hikvision Wi-Fi Camera EUVD-2026-75402

Exploitation requires a valid low-privileged authenticated session on the camera's management interface (PR:L confirmed by CVSS vector). The attacker must be able to reach the camera management interface over the network (AV:N). No user interaction is required and no special non-default configuration is needed beyond the camera being a Wi-Fi series model with an active low-privilege user account. Limiting factors: exploitation is blocked without at least one set of valid (even low-privilege) credentials; network segmentation or firewall rules that prevent access to camera management ports would prevent remote exploitation; cameras deployed in wired-only configurations may not expose sensitive Wi-Fi credential data. The vulnerability does not affect integrity or availability.

The CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately characterizes this as a moderate-severity, authenticated information-disclosure flaw. The PR:L requirement meaningfully limits scope: an attacker must first obtain valid low-privileged credentials to the camera's management interface, which is not freely available in unauthenticated scenarios. The confidentiality impact is rated C:L, but the practical severity may be somewhat higher if Wi-Fi pre-shared keys are returned in plaintext - possession of those credentials could enable lateral movement onto the wireless network segment. No EPSS data is available in the provided intelligence; KEV status is negative and no public exploit or POC is identified, confirming this is currently a theoretical risk rather than an actively abused vector. The primary realistic threat is an insider or a user with a compromised low-privilege camera account pivoting to broader network access via exposed Wi-Fi credentials.

An attacker with a compromised or legitimately obtained low-privilege camera account - such as a viewer account created for remote monitoring - authenticates to the camera's management interface and sends a crafted API request to a Wi-Fi configuration endpoint. The endpoint returns the device's Wi-Fi SSID and pre-shared key without enforcing privilege checks, giving the attacker credentials to join the local wireless network segment and potentially pivot to other systems. No public exploit code is required; the flaw likely requires only a simple HTTP GET or POST to a known API path.