Skip to content
CVE PROGRAM SOURCE RECORD7.2 High

CVE-2025-39240

Some Hikvision Wireless Access Point are vulnerable to authenticated remote command execution due to insufficient input validation. Attackers with valid credentials can exploit thi

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
hikvision

Description

Some Hikvision Wireless Access Point are vulnerable to authenticated remote command execution due to insufficient input validation. Attackers with valid credentials can exploit this flaw by sending crafted packets containing malicious commands to affected devices, leading to arbitrary command execution.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Hikvision DS-3WAP622G-SI

  • V1.1.5402 build241014（E2254P02）and the versions prior to itaffected

Hikvision DS-3WAP623E-SI

  • V1.1.5400 build240814（E2254）and the versions prior to itaffected

Hikvision DS-3WAP521-SI

Default version status: affected

  • V1.1.5400 build240814（E2254）and the versions prior to itaffected

Hikvision DS-3WAP522-SI

  • V1.1.5402 build241014（E2254P02）and the versions prior to itaffected

Hikvision DS-3WAP621E-SI

  • V1.1.5400 build240814（E2254）and the versions prior to itaffected

Hikvision DS-3WAP622E-SI

  • V1.1.5402 build241014（E2254P02）and the versions prior to itaffected

References