CVE-2026-85544
There is an Improper Encryption Configuration Vulnerability in some Hikvision Intercom Products....
Some Hikvision intercom products utilize an immutable factory value which should be obtained from local network or physical interaction with the device within their main card, which may allow attackers to forge a legitimate main card, thereby gaining the permission to issue cards.
Attack profile
How easy it is to exploit
- Attack vector
- Physical
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Some Hikvision intercom products utilize an immutable factory value which should be obtained from local network or physical interaction with the device within their main card, which may allow attackers to forge a legitimate main card, thereby gaining the permission to issue cards.
- Record
CVE-2026-85544- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-798, CWE-1310
- Updated
- 2026-11-02
EUVDEUVD-2026-75400
Some Hikvision intercom products utilize an immutable factory value which should be obtained from local network or physical interaction with the device within their main card, which may allow attackers to forge a legitimate main card, thereby gaining the permission to issue cards.
- Record
EUVD-2026-75400- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-xp4g-cgjh-m8f2
There is an Improper Encryption Configuration Vulnerability in some Hikvision Intercom Products....
There is an Improper Encryption Configuration Vulnerability in some Hikvision Intercom Products. This could allow attackers to forge M1 cards.
- Record
GHSA-xp4g-cgjh-m8f2- CVSS 3.1
- 5.2 Medium
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Weakness
- CWE-798, CWE-1310
- Updated
- 2026-11-02
NVD
Some Hikvision intercom products utilize an immutable factory value which should be obtained from local network or physical interaction with the device within their main card, which may allow attackers to forge a legitimate main card, thereby gaining the permission to issue cards.
- Record
CVE-2026-85544- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-798, CWE-1310
- Updated
- 2026-11-02
Affected products
- hikvision ds-kd8003
- hikvision ds-kd8005
- hikvision ds-kv6103
- hikvision ds-kv6113
- hikvision ds-kv6114
- hikvision ds-kv6124
- hikvision ds-kv6133
- hikvision ds-kv6134
- hikvision ds-kv8113
- hikvision ds-kv8114
- hikvision ds-kv8213
- hikvision ds-kv8413
Show 1 moreShow less
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-85544 is a medium vulnerability (CVSS 6.1) in Hikvision Ds-kd8003, published September 10, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.41%, the 35th percentile. No source names a fixed version.