Description
There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision NVR/DVR/CVR/IPC models. If exploited, an attacker on the same local area network (LAN) could cause the device to malfunction by sending specially crafted packets to an unpatched device.
Metrics
CVSS 3.1 8.8/10
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Hikvision | DS-96xxxNI-Hx | Build date before 250807 |
| Hikvision | DS-96xxxNI-Ix | Build date before 250807 |
| Hikvision | DS-96xxNXI-Sx | Build date before 250807 |
| Hikvision | DS-96xxxNXI-Sx | Build date before 250807 |
| Hikvision | DS-76xxNXI-Mx/VPro | Build date before 250807 |
| Hikvision | DS-96xxNXI-Mx/VPro | Build date before 250807 |
| Hikvision | DS-76xxNI-Mx | Build date before 250807 |
| Hikvision | DS-77xxNI-Mx | Build date before 250807 |
| Hikvision | DS-96xxNXI-Mx | Build date before 250807 |
| Hikvision | DS-96xxxNXI-Mx | Build date before 250807 |
| Hikvision | DS-86xxxNXI-Mx | Build date before 250807 |
| Hikvision | DS-76xxNXI-Ix/S | Build date before 250807 |
| Hikvision | DS-77xxNXI-Ix/S | Build date before 250807 |
| Hikvision | DS-86xxNXI-Ix/S | Build date before 250807 |
| Hikvision | DS-96xxNXI-Ix/S | Build date before 250807 |
| Hikvision | DS-76xxNXI-Ix/VPro | Build date before 250807 |
| Hikvision | DS-77xxNXI-Ix/VPro | Build date before 250807 |
| Hikvision | DS-76xxNXI-Kx(/xP) including(D)、(E)、(B) | Build date before 250807 |
| Hikvision | DS-77xxNXI-Kx(/xP) including(D)、(E)、(B) | Build date before 250807 |
| Hikvision | DS-76xxNXI-Kx(/xP)/Vpro | Build date before 250807 |
| Hikvision | DS-77xxNXI-Kx(/xP)/Vpro | Build date before 250807 |
| Hikvision | DS-76xxNI-Qx(/xP) including(D)、(E) | Build date before 250807 |
| Hikvision | DS-71xxNI-Q1(/xP)/M | Build date before 250807 |
| Hikvision | DS-71xxNI-Q1(/xP) | Build date before 250807 |
| Hikvision | DS-710xNI-G1/(xP)/M | Build date before 250807 |
| Hikvision | DS-71xxNI-Q1(/xP) | Build date before 250807 |
| Hikvision | DS-71xxNI-Q1(/xP)/M | Build date before 250807 |
| Hikvision | DS-76xxNI-Q1(/xP) | Build date before 250807 |
| Hikvision | DS-76xxNI-Q2(/xP) | Build date before 250807 |
| Hikvision | DS-76xxNXI-K1(/xP) | Build date before 250807 |
| Hikvision | DS-76xxNXI-K2(/xP) | Build date before 250807 |
| Hikvision | DS-77xxNXI-K4(/xP) | Build date before 250807 |
| Hikvision | DS-86xxNXI-K8(/xP) | Build date before 250807 |
| Hikvision | DS-76xxNXI-K1(/xP)/VPro | Build date before 250807 |
| Hikvision | DS-76xxNXI-K2(/xP)/VPro | Build date before 250807 |
| Hikvision | DS-77xxNXI-K4(/xP)/VPro | Build date before 250807 |
| Hikvision | iDS-71xxHGHI-M1(/T) | Build date before 250807 |
| Hikvision | iDS-72xxHGHI-M1(/T) | Build date before 250807 |
| Hikvision | iDS-71xxHQHI-M1(/T) | Build date before 250807 |
| Hikvision | iDS-72xxHQHI-M1(/T) | Build date before 250807 |
| Hikvision | iDS-72xxHQHI-Mx/XT | Build date before 250807 |
| Hikvision | iDS-72xxHUHI-Mx/XT | Build date before 250807 |
| Hikvision | iDS-72xxHTHI-Mx/XT | Build date before 250807 |
| Hikvision | iDS-90xxHUHI-M8/S(S) | Build date before 250807 |
| Hikvision | iDS-73xxHUHI-M4/S(S) | Build date before 250807 |
| Hikvision | iDS-81xxHUHI-M8/S(S) | Build date before 250807 |
| Hikvision | DS-71xxHGHI-M1(/T) | Build date before 250807 |
| Hikvision | DS-72xxHGHI-M1(/T) | Build date before 250807 |
| Hikvision | DS-ExxHGHI-xx | Build date before 250807 |
| Hikvision | iDS-71xxHQHI-M1/S | Build date before 250807 |
References
Timeline
- Published
- Jan 13, 2026
- Last modified
- Jul 9, 2026
- NVD status
- Deferred