CVE-2026-0709

HighRCE

Published: 30 January 2026

Published

30 January 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0002 6.1th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-0709 is a high-severity OS Command Injection (CWE-78) vulnerability in Hikvision Wireless Access (inferred from references). Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 6.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-0709 affects some Hikvision Wireless Access Points, enabling authenticated command execution due to insufficient input validation. The vulnerability, published on 2026-01-30, is classified under CWE-78 (OS Command Injection) and carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Attackers with valid credentials and high privileges can exploit the flaw remotely over the network with low complexity and no user interaction required. By sending crafted packets containing malicious commands to affected devices, they achieve arbitrary command execution, potentially compromising confidentiality, integrity, and availability with high impact.

Hikvision has published a security advisory on the command execution vulnerability in some Wireless Access Point products, available at https://www.hikvision.com/en/support/cybersecurity/security-advisory/command-execution-vulnerability-in-some-hikvision-wireless-access-point-products/.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-5039

Vulnerability details

Some Hikvision Wireless Access Points are vulnerable to authenticated command execution due to insufficient input validation. Attackers with valid credentials can exploit this flaw by sending crafted packets containing malicious commands to affected devices, leading to arbitrary command execution.

CWE(s): CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.008 Network Device CLI Execution

Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.

attack.mitre.org →

Why these techniques?

OS command injection on network device web/management interface directly enables remote exploitation of public-facing application (T1190) and arbitrary command execution via network device CLI (T1059.008).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1