CVE-2026-85544

State: Published
Severity: 6.1 Medium
Published: Sep 10, 2026
Updated: Sep 18, 2026
Reserved: Sep 4, 2026

Description

Some Hikvision intercom products utilize an immutable factory value which should be obtained from local network or physical interaction with the device within their main card, which may allow attackers to forge a legitimate main card, thereby gaining the permission to issue cards.

Scores

CVSS	Score	Vector	Source
3.1	6.1 Medium	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N	hikvision

Weaknesses

CWE-798 Use of Hard-coded Credentials
CWE-1310 Missing Ability to Patch ROM Code

Affected Products

Product	Versions
DS-KV9503Hikvision	V2.3.13 and the versions prior to itAffected
DS-KV6113Hikvision	V3.7.0 and the versions prior to itAffected
DS-KV6103Hikvision	V3.7.0 and the versions prior to itAffected
DS-KV6133Hikvision	V3.7.0 and the versions prior to itAffected
DS-KV8113Hikvision	V3.7.0 and the versions prior to itAffected
DS-KV8213Hikvision	V3.7.0 and the versions prior to itAffected
DS-KV8413Hikvision	V3.7.0 and the versions prior to itAffected
DS-KD8003Hikvision	V3.7.1 and the versions prior to itAffected
DS-KD8005Hikvision	V3.10.0 and the versions prior to itAffected
DS-KV6114Hikvision	V3.9.0 and the versions prior to itAffected
DS-KV6124Hikvision	V3.9.0 and the versions prior to itAffected
DS-KV6134Hikvision	V3.9.0 and the versions prior to itAffected
DS-KV8114Hikvision	V3.11.0 and the versions prior to itAffected

References

https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-some-hikvision-intercom-products

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.