CVE-2026-85544

MediumCVSS 6.1/10Last modified Sep 18, 2026

Description

Some Hikvision intercom products utilize an immutable factory value which should be obtained from local network or physical interaction with the device within their main card, which may allow attackers to forge a legitimate main card, thereby gaining the permission to issue cards.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-798CWE-1310

Affected software

VendorProductVersions
HikvisionDS-KV9503V2.3.13 and the versions prior to it
HikvisionDS-KV6113V3.7.0 and the versions prior to it
HikvisionDS-KV6103V3.7.0 and the versions prior to it
HikvisionDS-KV6133V3.7.0 and the versions prior to it
HikvisionDS-KV8113V3.7.0 and the versions prior to it
HikvisionDS-KV8213V3.7.0 and the versions prior to it
HikvisionDS-KV8413V3.7.0 and the versions prior to it
HikvisionDS-KD8003V3.7.1 and the versions prior to it
HikvisionDS-KD8005V3.10.0 and the versions prior to it
HikvisionDS-KV6114V3.9.0 and the versions prior to it
HikvisionDS-KV6124V3.9.0 and the versions prior to it
HikvisionDS-KV6134V3.9.0 and the versions prior to it
HikvisionDS-KV8114V3.11.0 and the versions prior to it

References

Timeline

Published
Sep 10, 2026
Last modified
Sep 18, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-855457.1There is an Vulnerability in some HikCentral Access Control versions. Authenticated low-privilege users can invoke API interfaces that theirCVE-2026-855468.6MISP contains a cross-site request forgery (CSRF) vulnerability in the sharing group quick-edit functionality. The addOrg, removeOrg, addSerCVE-2026-855476.2A cross-site request forgery (CSRF) vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether aCVE-2026-85558.8Use after free in GTK in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code via a crafted CVE-2026-85563.1Inappropriate implementation in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the CVE-2026-855686.8The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value before rewriting an already preCVE-2026-855697.2The Tutor LMS WordPress plugin before 4.0.8 does not correctly determine whether an incoming request is addressed to its own REST API, and CVE-2026-85577.5Use after free in Accessibility in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process CVE-2026-855704.3The Tutor LMS WordPress plugin before 4.2.0 does not prevent the correct answers to quiz questions from being included in the page it serveCVE-2026-855716.5The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering requests belong to a courseCVE-2026-855724.3The Tutor LMS WordPress plugin before 4.0.8 does not check that a user has access to a course before returning its lesson discussion contenCVE-2026-855738.8The All in One Files Upload WordPress plugin before 2.0.17 adds SVG to the site's allowed upload types and does not sanitise uploaded files
CVE-2026-85544: Medium severity, CVSS 6.1 | Vulnix