Ds 2Cd Series
Monthly
Unauthenticated remote information disclosure in Hikvision DS-2CD and DS-2DE series IP cameras exposes partial device memory contents to network-accessible attackers without any credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no user interaction against default configurations, making the attack surface broad given the cameras' typical internet or LAN exposure. While confidentiality impact is rated Low (partial memory only), leaked memory may contain sensitive fragments such as session tokens or configuration data, and no public exploit or CISA KEV listing is confirmed at time of analysis.
Denial-of-service via stack-based buffer overflow affects Hikvision DS-2CD and DS-2DE series IP cameras, where an authenticated attacker sending specially crafted network packets can corrupt memory and force device malfunction. The vendor's CVSS vector claims full confidentiality and integrity impact (C:H/I:H) in addition to availability, hinting at possible code execution beyond the DoS described, though the advisory text only states device malfunction. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Denial of service (with potential memory corruption) in select Hikvision network cameras - specifically the DS-2CD and DS-2DE series - lets remote unauthenticated attackers crash or destabilize a device by sending specially crafted packets that trigger a heap buffer overflow. The flaw carries a CVSS 7.7 (AV:N/PR:N) and, per the supplied CVSS vector, high integrity and availability impact, though the vendor advisory characterizes the primary observable effect as device malfunction. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Information disclosure in the firmware of multiple Hikvision network camera families (DS-2CD, DS-2DE, DS-2DP, DS-2TD series) allows remote unauthenticated attackers to retrieve partial sensitive data by sending requests with improperly validated input parameters. The flaw was self-reported by Hikvision and rated CVSS 7.5 (confidentiality-only impact); no public exploit identified at time of analysis. Because these cameras are frequently internet-exposed, the network-reachable, no-authentication nature of the issue makes it a meaningful exposure risk despite the absence of integrity or availability impact.
Privilege escalation in Hikvision DS-2CD series IP cameras allows an SSH-authenticated attacker to gain full administrative control of the device by exploiting incorrect permission allocation in the device firmware. The vulnerability requires prior SSH authentication, making it an insider or credential-theft-dependent threat rather than an unauthenticated remote attack. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but successful exploitation delivers complete confidentiality, integrity, and availability compromise of the affected camera.
Unauthenticated remote information disclosure in Hikvision DS-2CD and DS-2DE series IP cameras exposes partial device memory contents to network-accessible attackers without any credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no user interaction against default configurations, making the attack surface broad given the cameras' typical internet or LAN exposure. While confidentiality impact is rated Low (partial memory only), leaked memory may contain sensitive fragments such as session tokens or configuration data, and no public exploit or CISA KEV listing is confirmed at time of analysis.
Denial-of-service via stack-based buffer overflow affects Hikvision DS-2CD and DS-2DE series IP cameras, where an authenticated attacker sending specially crafted network packets can corrupt memory and force device malfunction. The vendor's CVSS vector claims full confidentiality and integrity impact (C:H/I:H) in addition to availability, hinting at possible code execution beyond the DoS described, though the advisory text only states device malfunction. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Denial of service (with potential memory corruption) in select Hikvision network cameras - specifically the DS-2CD and DS-2DE series - lets remote unauthenticated attackers crash or destabilize a device by sending specially crafted packets that trigger a heap buffer overflow. The flaw carries a CVSS 7.7 (AV:N/PR:N) and, per the supplied CVSS vector, high integrity and availability impact, though the vendor advisory characterizes the primary observable effect as device malfunction. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Information disclosure in the firmware of multiple Hikvision network camera families (DS-2CD, DS-2DE, DS-2DP, DS-2TD series) allows remote unauthenticated attackers to retrieve partial sensitive data by sending requests with improperly validated input parameters. The flaw was self-reported by Hikvision and rated CVSS 7.5 (confidentiality-only impact); no public exploit identified at time of analysis. Because these cameras are frequently internet-exposed, the network-reachable, no-authentication nature of the issue makes it a meaningful exposure risk despite the absence of integrity or availability impact.
Privilege escalation in Hikvision DS-2CD series IP cameras allows an SSH-authenticated attacker to gain full administrative control of the device by exploiting incorrect permission allocation in the device firmware. The vulnerability requires prior SSH authentication, making it an insider or credential-theft-dependent threat rather than an unauthenticated remote attack. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but successful exploitation delivers complete confidentiality, integrity, and availability compromise of the affected camera.