7.2
/ 10
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Description
Some Hikvision switch products (discontinued since December 2023) are vulnerable to authenticated remote command execution due to insufficient input validation. Attackers with valid credentials can exploit this flaw by sending crafted packets containing malicious commands to affected devices, leading to arbitrary command execution.
Basic Information
ID
CVE-2026-3828
Source
hikvision
Published
May 9, 2026 at 08:27
Affected Product
Vendor
Hikvision
Product
DS-3E1310P-SI
Version
Versions below V1.2.4_210623 (including V1.2.4_210623)
Affected Versions
Hikvision DS-3E1310P-SI Versions below V1.2.4_210623 (including V1.2.4_210623)
Hikvision DS-3E1318P-SI Versions below V1.2.0_210823 (including V1.2.0_210823)
Hikvision DS-3E1326P-SI Versions below V1.2.0_210823 (including V1.2.0_210823)
Hikvision DS-3E1318P-SI Versions below V1.2.0_210823 (including V1.2.0_210823)
Hikvision DS-3E1326P-SI Versions below V1.2.0_210823 (including V1.2.0_210823)