Hikvision Security Bulletin: Privilege Escalation, Buffer Overflow & Info Disclosure (CVE-2026-57599, CVE-2026-57600, CVE-2026-61390)

Vulnerability Overview CVE-2026-57599: Privilege escalation vulnerability allowing attackers to gain complete control of the device after SSH authentication. CVE-2026-57600: Insufficient input parameter validation, allowing unauthorized users to access certain sensitive data. CVE-2026-61390: Heap buffer overflow vulnerability, which may cause device failure. CVE-2026-61391: Stack buffer overflow vulnerability, which may cause device failure. CVE-2026-61392: Information disclosure vulnerability, allowing unauthorized users to retrieve partial information from device memory. Affected Scope Refer to the official link for affected Hikvision camera model numbers. Use Hikvision Delivery Assistant for batch firmware upgrades. Refer to the Security Camera Deployment Guide for specific deployment risks and appropriate security control measures. Remediation Visit the official link for information on specifically affected models. Use Hikvision Delivery Assistant for batch firmware upgrades. Refer to the Security Camera Deployment Guide to assess deployment risks and implement security controls. Additional Information The vulnerability was authored by the Hikvision Security Response Center (HSRC), with the initial publication date of 2026-07-22. Vulnerability scores are based on the CVSS v3.1 standard. Vulnerability source: Joffrey Czarny and Daniel Kaye of Inversus Labs, and the Bitdefender IoT Security Team. Report security issues to HSRC: hsrc@hikvision.com. Disclaimer The documentation is provided "AS IS" without warranty. Hikvision and its subsidiaries are not liable for damages resulting from the use of this document. Hikvision reserves the right to revise or update this document at any time.

Goal Reached Thanks to every supporter — we hit 100%!

Hikvision Security Bulletin: Privilege Escalation, Buffer Overflow & Info Disclosure (CVE-2026-57599, CVE-2026-57600, CVE-2026-61390)