CVE-2026-3828
Received Received - Intake
Authenticated Remote Command Execution in Hikvision Switch Products

Publication date: 2026-05-09

Last updated on: 2026-05-11

Assigner: Hangzhou Hikvision Digital Technology Co., Ltd.

Description
Some Hikvision switch products (discontinued since December 2023) are vulnerable to authenticated remote command execution due to insufficient input validation. Attackers with valid credentials can exploit this flaw by sending crafted packets containing malicious commands to affected devices, leading to arbitrary command execution.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-09
Last Modified
2026-05-11
Generated
2026-06-19
AI Q&A
2026-05-09
EPSS Evaluated
2026-06-18
NVD
CVE-2026-3828
EUVD
EUVD-2026-28908
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
hikvision switch to 2023-12-31 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Impact Analysis

The vulnerability can have a significant impact because it allows attackers with valid credentials to execute arbitrary commands on the affected devices remotely. This can lead to full compromise of the device, potentially affecting the confidentiality, integrity, and availability of the network and systems connected to these switches.

Executive Summary

This vulnerability affects some Hikvision switch products that were discontinued in December 2023. It is an authenticated remote command execution flaw caused by insufficient input validation. Attackers who have valid credentials can exploit this vulnerability by sending specially crafted packets containing malicious commands to the affected devices, which allows them to execute arbitrary commands remotely.

Compliance Impact

The vulnerability allows authenticated remote command execution on affected Hikvision switch products, which can lead to arbitrary command execution with high impact on confidentiality, integrity, and availability.

Such a vulnerability could potentially impact compliance with standards and regulations like GDPR and HIPAA, as it threatens the security of sensitive data and system integrity.

However, there is no specific information provided in the available context or resources about direct effects on compliance with these regulations.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-3828. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart