CVE-2026-3828
Authenticated Remote Command Execution in Hikvision Switch Products
Publication date: 2026-05-09
Last updated on: 2026-05-11
Assigner: Hangzhou Hikvision Digital Technology Co., Ltd.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| hikvision | switch | to 2023-12-31 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
The vulnerability can have a significant impact because it allows attackers with valid credentials to execute arbitrary commands on the affected devices remotely. This can lead to full compromise of the device, potentially affecting the confidentiality, integrity, and availability of the network and systems connected to these switches.
Can you explain this vulnerability to me?
This vulnerability affects some Hikvision switch products that were discontinued in December 2023. It is an authenticated remote command execution flaw caused by insufficient input validation. Attackers who have valid credentials can exploit this vulnerability by sending specially crafted packets containing malicious commands to the affected devices, which allows them to execute arbitrary commands remotely.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows authenticated remote command execution on affected Hikvision switch products, which can lead to arbitrary command execution with high impact on confidentiality, integrity, and availability.
Such a vulnerability could potentially impact compliance with standards and regulations like GDPR and HIPAA, as it threatens the security of sensitive data and system integrity.
However, there is no specific information provided in the available context or resources about direct effects on compliance with these regulations.