CVE-2026-85544

Summary

Some Hikvision intercom products utilize an immutable factory value which should be obtained from local network or physical interaction with the device within their main card, which may allow attackers to forge a legitimate main card, thereby gaining the permission to issue cards.

Affected Software

VendorProductVersion RangeStatus
HikvisionDS-KV9503V2.3.13 and the versions prior to itaffected
HikvisionDS-KV6113V3.7.0 and the versions prior to itaffected
HikvisionDS-KV6103V3.7.0 and the versions prior to itaffected
HikvisionDS-KV6133V3.7.0 and the versions prior to itaffected
HikvisionDS-KV8113V3.7.0 and the versions prior to itaffected
HikvisionDS-KV8213V3.7.0 and the versions prior to itaffected
HikvisionDS-KV8413V3.7.0 and the versions prior to itaffected
HikvisionDS-KD8003V3.7.1 and the versions prior to itaffected
HikvisionDS-KD8005V3.10.0 and the versions prior to itaffected
HikvisionDS-KV6114V3.9.0 and the versions prior to itaffected
HikvisionDS-KV6124V3.9.0 and the versions prior to itaffected
HikvisionDS-KV6134V3.9.0 and the versions prior to itaffected
HikvisionDS-KV8114V3.11.0 and the versions prior to itaffected

Weaknesses

  • CWE-798: CWE-798 Use of Hard-coded Credentials

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References