What happened
A high-severity vulnerability in Hikvision wireless access points can allow authenticated attackers to execute malicious commands on affected devices. The flaw, tracked as CVE-2026-0709, stems from insufficient input validation in the firmware of multiple wireless access point models manufactured by Hikvision. According to the disclosed advisory, attackers who have valid credentials can send specially crafted packets containing malicious commands to the wireless access points, which may bypass security controls and trigger arbitrary command execution. The vulnerability received a CVSS v3.1 base score of 7.2, indicating a high severity. Affected models include several in the DS-3WAP series running firmware versions V1.1.6303 build250812 and earlier. Hikvision has released patched firmware (V1.1.6601 build251223) for all impacted access point models to address the issue.Â
Who is affected
Operators and administrators of affected Hikvision wireless access points with vulnerable firmware are directly affected, as the flaw allows authenticated users to execute arbitrary commands on the devices.
Why CISOs should care
Authenticated command execution vulnerabilities in wireless infrastructure can undermine network integrity and confidentiality, allowing attackers with credentials to manipulate device behavior and potentially impact broader network operations.
3 practical actions
- Apply firmware updates. Upgrade affected Hikvision access points to the resolved firmware version (V1.1.6601 build251223).
- Review privileged user accounts. Ensure administrative credentials for wireless infrastructure are tightly controlled and monitored.
- Segment access point management. Restrict access to management interfaces to trusted internal networks to reduce authenticated attack opportunities.