EUVD-2026-75402
GHSA-wrq3-828r-6crw
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-accessible management interface, low-priv auth required (PR:L), partial confidentiality loss (Wi-Fi config); no integrity or availability impact.
Primary rating from Vendor (hikvision).
CVSS VectorVendor: hikvision
Lifecycle Timeline
2DescriptionCVE.org
Some Wi-Fi series camera products have insufficient permission validation on certain interfaces, allowing authenticated low-privileged users to obtain device Wi-Fi configuration information through these interfaces.
AnalysisAI
Insufficient permission validation on management interfaces in Hikvision Wi-Fi series cameras allows authenticated low-privileged users to retrieve the device's Wi-Fi configuration via unauthorized API calls. The flaw stems from missing authorization checks on specific endpoints that expose network configuration data, potentially including SSID and pre-shared key material. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privileged authenticated session on the camera's management interface (PR:L confirmed by CVSS vector). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) accurately characterizes this as a moderate-severity, authenticated information-disclosure flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade all affected Hikvision Wi-Fi series cameras to firmware version V5.7.26 or later, which resolves the insufficient permission validation. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today