Hikvision Switches: Authenticated RCE in Discontinued Products

The National Vulnerability Database (NVD) has detailed CVE-2026-3828, a high-severity authenticated remote command execution (RCE) vulnerability affecting some Hikvision switch products. The flaw, rated 7.2 CVSS, stems from insufficient input validation, allowing attackers with valid credentials to execute arbitrary commands by sending specially crafted packets.

While Hikvision discontinued these specific switch models in December 2023, the vulnerability remains a critical concern for organizations still operating legacy hardware. An attacker gaining valid credentials—a common outcome of phishing or brute-force attacks—could leverage this RCE to gain full control over the affected network switches, potentially leading to network disruption, data interception, or further lateral movement within the environment.

Defenders cannot simply ignore this because the products are EOL. The attacker’s calculus here is simple: target the unpatched, forgotten, or end-of-life devices. These often remain operational, unmonitored, and unpatched, presenting a low-risk, high-reward entry point for adversaries. Assume these devices are prime targets.