{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: Hikvision vulnerabilities","home_page_url":"https://patchfirst.co/vendor/hikvision/","feed_url":"https://patchfirst.co/feed/vendor/hikvision.json","description":"New and newly exploited Hikvision CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2017-7921#kev","url":"https://patchfirst.co/cve/CVE-2017-7921/","title":"[KEV] CVE-2017-7921: Hikvision Multiple Products Improper Authentication Vulnerability","content_text":"Hikvision · Multiple Products. In CISA KEV since 2026-03-05. ENISA EUVD lists it as exploited. EPSS >99.9% (higher than 99.99% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 69.9 of 100.","summary":"Hikvision Multiple Products Improper Authentication Vulnerability","date_published":"2026-03-05T00:00:00.000Z","date_modified":"2026-06-17T01:25:28.000Z","tags":["kev","public-exploit","T1190","T1078"],"_patchfirst":{"reason":"kev","priority":69.9,"kev":{"dateAdded":"2026-03-05","ransomware":false},"epss":{"score":0.99998,"percentile":0.9999},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Hikvision","product":"Multiple Products","techniqueIds":["T1190","T1078"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-58274","url":"https://patchfirst.co/cve/CVE-2024-58274/","title":"CVE-2024-58274: Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2024-08-01 allows execution of a…","content_text":"Hikvision · CSMP iSecure Center. Not in CISA KEV. EPSS 17.4% (higher than 97.1% of CVEs). CVSS 8.3 HIGH. Priority 60.2 of 100.","summary":"Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2024-08-01 allows execution of a…","date_published":"2025-10-22T00:00:00.000Z","date_modified":"2025-10-22T13:55:16.000Z","tags":[],"_patchfirst":{"reason":"published","priority":60.2,"kev":null,"epss":{"score":0.17368,"percentile":0.97113},"cvss":{"score":8.3,"severity":"HIGH","version":"3.1"},"vendor":"Hikvision","product":"CSMP iSecure Center","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2023-53691","url":"https://patchfirst.co/cve/CVE-2023-53691/","title":"CVE-2023-53691: Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2023-06-25 allows file upload via…","content_text":"Hikvision · CSMP iSecure Center. Not in CISA KEV. EPSS 1.3% (higher than 70.1% of CVEs). CVSS 8.3 HIGH. Priority 54.8 of 100.","summary":"Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2023-06-25 allows file upload via…","date_published":"2025-10-22T00:00:00.000Z","date_modified":"2025-10-22T13:56:44.000Z","tags":[],"_patchfirst":{"reason":"published","priority":54.8,"kev":null,"epss":{"score":0.01286,"percentile":0.70119},"cvss":{"score":8.3,"severity":"HIGH","version":"3.1"},"vendor":"Hikvision","product":"CSMP iSecure Center","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2025-34067","url":"https://patchfirst.co/cve/CVE-2025-34067/","title":"CVE-2025-34067: Hikvision Integrated Security Management Platform Remote Command Execution via applyCT Fastjson","content_text":"Hikvision · Integrated Security Management Platform. Not in CISA KEV. EPSS 22.0% (higher than 97.7% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. Priority 67.2 of 100.","summary":"Hikvision Integrated Security Management Platform Remote Command Execution via applyCT Fastjson","date_published":"2025-07-02T00:00:00.000Z","date_modified":"2026-07-14T22:25:42.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":67.2,"kev":null,"epss":{"score":0.2197,"percentile":0.97655},"cvss":{"score":10,"severity":"CRITICAL","version":"4.0"},"vendor":"Hikvision","product":"Integrated Security Management Platform","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2023-6895","url":"https://patchfirst.co/cve/CVE-2023-6895/","title":"CVE-2023-6895: Hikvision Intercom Broadcasting System ping.php os command injection","content_text":"Hikvision · Intercom Broadcasting System. Not in CISA KEV. EPSS 89.0% (higher than 99.78% of CVEs). CVSS 6.3 MEDIUM. Public exploit code exists. Priority 71.6 of 100.","summary":"Hikvision Intercom Broadcasting System ping.php os command injection","date_published":"2023-12-17T00:00:00.000Z","date_modified":"2024-11-21T14:28:13.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":71.6,"kev":null,"epss":{"score":0.89029,"percentile":0.99778},"cvss":{"score":6.3,"severity":"MEDIUM","version":"3.1"},"vendor":"Hikvision","product":"Intercom Broadcasting System","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2023-6893","url":"https://patchfirst.co/cve/CVE-2023-6893/","title":"CVE-2023-6893: Hikvision Intercom Broadcasting System exportrecord.php path traversal","content_text":"Hikvision · Intercom Broadcasting System. Not in CISA KEV. EPSS 70.2% (higher than 99.38% of CVEs). CVSS 4.3 MEDIUM. Public exploit code exists. Priority 27.9 of 100.","summary":"Hikvision Intercom Broadcasting System exportrecord.php path traversal","date_published":"2023-12-17T00:00:00.000Z","date_modified":"2024-08-02T08:42:08.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":27.9,"kev":null,"epss":{"score":0.70224,"percentile":0.9938},"cvss":{"score":4.3,"severity":"MEDIUM","version":"3.1"},"vendor":"Hikvision","product":"Intercom Broadcasting System","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2021-36260#kev","url":"https://patchfirst.co/cve/CVE-2021-36260/","title":"[KEV] CVE-2021-36260: Hikvision Improper Input Validation","content_text":"Hikvision · Security cameras web server. In CISA KEV since 2022-01-10. ENISA EUVD lists it as exploited. EPSS 99.9% (higher than 99.96% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Named in 1 threat report. Priority 73.7 of 100.","summary":"Hikvision Improper Input Validation","date_published":"2022-01-10T00:00:00.000Z","date_modified":"2026-06-17T03:58:34.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":73.7,"kev":{"dateAdded":"2022-01-10","ransomware":false},"epss":{"score":0.99869,"percentile":0.99963},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1"},"vendor":"Hikvision","product":"Security cameras web server","techniqueIds":["T1190","T1059"],"reportCount":1,"hasPublicExploit":true,"euvdExploited":true}}]}