Command Injection Flaw in Hikvision Access Points Allows Authenticated Code Execution

The Input Validation Failure

The core issue here is a failure in input validation that allows authenticated users to send specially crafted packets containing malicious commands directly to the wireless access point. What makes this particularly dangerous is that the attack bypasses network perimeter defenses because it requires valid credentials to execute. Once an attacker has authenticated to the device, they can inject commands that the system executes with device-level privileges. This creates a pathway to complete system compromise through what should be routine administrative access.

The vulnerability affects six different Hikvision WAP models running firmware version V1.1.6303 build250812 or earlier. The affected products span their enterprise wireless infrastructure line, from the DS-3WAP521-SI and DS-3WAP522-SI models through the DS-3WAP621E-SI, DS-3WAP622E-SI, DS-3WAP623E-SI, and DS-3WAP622G-SI variants.

Affected Model	Vulnerable Firmware Version
DS-3WAP521-SI	V1.1.6303 build250812 and earlier
DS-3WAP522-SI	V1.1.6303 build250812 and earlier
DS-3WAP621E-SI	V1.1.6303 build250812 and earlier
DS-3WAP622E-SI	V1.1.6303 build250812 and earlier
DS-3WAP623E-SI	V1.1.6303 build250812 and earlier
DS-3WAP622G-SI	V1.1.6303 build250812 and earlier

Discovery and Disclosure Timeline

The vulnerability was reported by an independent security researcher, exzettabyte, on January 30, 2026. Hikvision responded by releasing patched firmware version V1.1.6601 build 251223 that addresses the command injection flaw across all affected device models. The patches are currently available through Hikvision’s official support portal for immediate deployment.

Attack Vector and Enterprise Risk

The authenticated requirement for this vulnerability creates an interesting risk profile. While attackers need valid device credentials, several scenarios make this a realistic threat in enterprise environments. Compromised user accounts represent the most obvious attack vector. If an organization has weak password policies or has experienced credential theft through phishing or other means, those credentials can be leveraged for exploitation. Stolen credentials from previous breaches also present a risk, particularly if organizations haven’t rotated credentials on their network infrastructure devices. Insider threats represent another significant concern, where malicious employees or contractors with legitimate access can exploit the vulnerability for reconnaissance, lateral movement, or sabotage.

Once an attacker successfully authenticates and exploits the input validation flaw, they gain the ability to execute arbitrary commands with device privileges. This can lead to complete system compromise, allowing attackers to modify device configurations, intercept network traffic passing through the access point, establish persistent backdoors for ongoing access, pivot to other network segments, or disable security logging to cover their tracks.

Remediation Requirements

Organizations operating any of the affected Hikvision WAP models need to take immediate action. The primary remediation step is deploying firmware version V1.1.6601 build 251223 across all vulnerable devices in the infrastructure. This should be treated as a priority patch given the severity score and the potential for complete device compromise.

Beyond patching, organizations should implement several additional security controls. Access controls need review and hardening to ensure device access is restricted to authorized personnel only. Strong authentication mechanisms should be enforced, including complex password requirements and consideration of multi-factor authentication where supported. Credential rotation is recommended for all affected devices, particularly in environments where credential compromise is suspected or where credentials haven’t been changed recently.

For organizations that cannot patch immediately due to change control processes or operational constraints, interim protective measures should be implemented. Network segmentation can restrict device access to management VLANs or specific administrative subnets. Authentication logs should be monitored for suspicious activity, unusual login patterns, failed authentication attempts, or access from unexpected source addresses. Rate limiting on authentication attempts can help slow down brute-force attacks targeting device credentials.

Broader Implications for Infrastructure Security

This vulnerability underscores several persistent challenges in securing network infrastructure devices. Command injection vulnerabilities remain one of the most common and dangerous flaws in embedded systems and network appliances. The fact that we’re still seeing insufficient input validation in enterprise-grade wireless infrastructure in 2026 suggests that secure coding practices haven’t been universally adopted across the networking hardware industry. Input validation should be a fundamental security control applied to every user-supplied parameter, yet these flaws continue to surface with regularity.

The authenticated nature of this vulnerability highlights why defense in depth matters so critically. Organizations that rely solely on device authentication as their security boundary are vulnerable when those credentials are compromised. Network infrastructure devices need to be treated as high-value targets that warrant additional protective layers beyond basic authentication. This includes network segmentation to limit administrative access, monitoring and alerting on device access patterns, regular credential rotation policies, and restriction of device management interfaces to dedicated out-of-band management networks where feasible.

Hikvision’s security track record deserves consideration as well. The company has faced scrutiny for various security issues over the years, and organizations deploying their equipment need to maintain heightened vigilance around security updates and vulnerability disclosures. Some organizations, particularly in government and critical infrastructure sectors, may need to evaluate whether continued use of Hikvision equipment aligns with their security requirements and risk tolerance. This isn’t about singling out one vendor, it’s about recognizing that different vendors have different security postures and that procurement decisions should factor in security history alongside features and cost.

The relatively quick patch release is encouraging and suggests Hikvision’s security response capabilities have matured. However, organizations shouldn’t assume patches will always arrive this quickly. Every network infrastructure device should have a documented inventory, a regular patching schedule, and monitoring for security advisories from the vendor. Too often, these devices get deployed and forgotten until they become attack vectors.