CVE-2026-3828
Authenticated Remote Command Execution in Hikvision Switch Products
Publication date: 2026-05-09
Last updated on: 2026-05-09
Assigner: Hangzhou Hikvision Digital Technology Co., Ltd.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| hikvision | switch | to 2023-12-31 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
The vulnerability can have a significant impact because it allows attackers with valid credentials to execute arbitrary commands on the affected devices remotely. This can lead to full compromise of the device, potentially affecting the confidentiality, integrity, and availability of the network and systems connected to these switches.
Can you explain this vulnerability to me?
This vulnerability affects some Hikvision switch products that were discontinued in December 2023. It is an authenticated remote command execution flaw caused by insufficient input validation. Attackers who have valid credentials can exploit this vulnerability by sending specially crafted packets containing malicious commands to the affected devices, which allows them to execute arbitrary commands remotely.