CVE-2026-57599

MediumCVSS 6.6/10Last modified Oct 24, 2026

Description

There is a privilege escalation vulnerability in some Hikvision cameras. Due to incorrect permission allocation in the device program, attackers can escalate privileges and gain full control of the device after authenticating via SSH.

Metrics

CVSS 3.1 6.6/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

No affected versions have been published.

Timeline

Published: Jul 22, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-57609.8SGLang's reranking endpoint (/v1/rerank) achieves Remote Code Execution (RCE) when a model file containing a malcious tokenizer.chat_templat CVE-2026-576007.5Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthenticated attackers to retrieve partial s CVE-2026-576176.5Contributor Cross Site Scripting (XSS) in SeedProd Pro < 6.19.5 versions.CVE-2026-576186.5Contributor Cross Site Scripting (XSS) in Neve PRO <= 3.1.2 versions.CVE-2026-576196.5Contributor Sensitive Data Exposure in Elementor Website Builder <= 4.1.3 versions.CVE-2026-57625.3Allocation of resources without limits or throttling vulnerability in Wikimedia Foundation MediaWiki - ReportIncident Extension allows HTTP CVE-2026-576206.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim Strifler Exclusive Addons Elemento CVE-2026-576219.8Unauthenticated PHP Object Injection in Booktics <= 1.0.21 versions.CVE-2026-576224.3Subscriber Broken Access Control in WPCafe <= 3.0.14 versions.CVE-2026-576239.0Unauthenticated Arbitrary Code Execution in W3 Total Cache <= 2.9.4 versions.CVE-2026-5762410.0Unauthenticated Remote Code Execution (RCE) in Blocksy Companion Pro <= 2.1.46 versions.CVE-2026-576259.6Unauthenticated Cross Site Scripting (XSS) in Admin and Site Enhancements (ASE) Pro <= 8.8.5 versions.