CVE-2026-22623
Unknown
Unknown - Not Provided
Command Injection in HIKSEMI NAS via Insufficient Input Validation
Publication date: 2026-01-30
Last updated on: 2026-02-27
Assigner: Hangzhou Hikvision Digital Technology Co., Ltd.
Description
Description
Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can execute arbitrary commands on the device by crafting specific messages.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| hiksemi | nas | * |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists because the interface of certain HIKSEMI NAS products does not properly validate input parameters. As a result, authenticated users can craft specific messages that allow them to execute arbitrary commands on the device.
How can this vulnerability impact me? :
An attacker who is an authenticated user can exploit this vulnerability to execute arbitrary commands on the affected device. This can lead to full compromise of the device, including unauthorized access, data manipulation, or disruption of services.
Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70