PT-2026-39325 · Hikvision · Hikvision Switch

Thiago Torres · Published 2026-05-09 · Updated 2026-05-12 · CVE-2026-3828

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hikvision switch products (affected versions not specified)

Description Certain Hikvision switch products, discontinued since December 2023, contain a flaw allowing authenticated remote command execution. This issue stems from insufficient input validation, which enables attackers possessing valid credentials to execute arbitrary commands by sending crafted packets to the affected devices.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2026-3828

Affected Products

Hikvision Switch

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-3828 · Security Note
• https://twitter.com/CVEnew/status/2053131374895546450 · Twitter Post
• https://twitter.com/SelvaKtm2/status/2053464610871922948 · Twitter Post
• https://t.me/CVEtracker/53220 · Telegram Post
• https://t.me/cveNotify/162865 · Telegram Post
• https://hikvision.com/en/support/cybersecurity/security-advisory/command-execution-vulnerability-in-some-hikvision-switch-product · Note
• https://twitter.com/VigneshVic23698/status/2054072164727632044 · Twitter Post
• https://twitter.com/unknownmatter19/status/2053891394310385812 · Twitter Post
• https://twitter.com/CVEarity/status/2053830190086943005 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2053085785214054405 · Twitter Post