CVE-2026-1749 — Some HikCentral Professional Versions. This Vulnerability

title: Unauthenticated Access to Admin Functions in HikCentral Professional — CVE-2026-1749
id: scw-2026-05-09-ai-1
status: experimental
level: critical
description: |
  Detects an unauthenticated user attempting to gain admin privileges by exploiting an access control vulnerability in HikCentral Professional. This rule specifically looks for POST requests to the user login API endpoint with a query parameter indicating an attempt to assign admin role, which is indicative of CVE-2026-1749.
author: SCW Feed Engine (AI-generated)
date: 2026-05-09
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-1749/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/hikvision/v1/api/users/login'
      cs-method:
          - 'POST'
      sc-status:
          - 200
      cs-uri-query|contains:
          - 'role=admin'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse