CVE-2026-57599: Hikvision Camera Privilege Escalation Flaw

CVE-2026-57599 Overview

CVE-2026-57599 is a privilege escalation vulnerability affecting select Hikvision camera models. The flaw stems from incorrect permission allocation within the device program. An attacker who has already authenticated to the camera via Secure Shell (SSH) can escalate privileges and gain full control of the device. The vulnerability is categorized under CWE-269: Improper Privilege Management.

Critical Impact
Successful exploitation grants attackers full administrative control of affected Hikvision cameras, compromising confidentiality, integrity, and availability of video surveillance infrastructure.

Affected Products

Select Hikvision network cameras (specific models listed in the vendor advisory)
Camera firmware versions with the SSH service enabled and vulnerable permission allocation
Refer to the Hikvision Security Advisory for the definitive affected product list

Discovery Timeline

2026-07-22 - CVE-2026-57599 published to the National Vulnerability Database (NVD)
2026-07-22 - Last updated in the NVD database

Technical Details for CVE-2026-57599

Vulnerability Analysis

The vulnerability resides in the permission model of the Hikvision camera device program. After a user authenticates over SSH, the affected firmware assigns permissions that exceed the intended scope of the authenticated session. This misallocation allows an attacker to transition from a limited-privilege shell to full device control.

The issue is a classic instance of improper privilege management [CWE-269]. The device program does not enforce the principle of least privilege for authenticated SSH sessions. Once elevated, an attacker can modify device configuration, tamper with video streams, disable security controls, or use the camera as a pivot point into adjacent networks.

Exploitation requires prior authentication and network access to the SSH service, which limits opportunistic attacks. However, cameras frequently ship with default or shared credentials, and compromised administrator credentials are a common precursor in real-world intrusions.

Root Cause

The root cause is incorrect permission allocation within the camera device program. Components accessible to an authenticated SSH user execute with privileges higher than required, providing a path to escalate to full device control.

Attack Vector

The attack vector is network-based and requires high privileges plus successful SSH authentication. No user interaction is required. Once authenticated, the attacker leverages the misallocated permissions to execute privileged operations, achieving complete compromise of the camera. See the Hikvision Security Advisory for vendor-specific technical details. No public proof-of-concept code has been published.

Detection Methods for CVE-2026-57599

Indicators of Compromise

Unexpected SSH login sessions to Hikvision camera management interfaces, particularly from unfamiliar source IP addresses
Configuration changes on cameras made outside of scheduled maintenance windows
Unauthorized firmware modifications, new user accounts, or altered network routing on affected devices
Outbound network connections from cameras to unknown external hosts, suggesting post-exploitation activity

Detection Strategies

Monitor SSH authentication logs on Hikvision devices and network aggregation points for anomalous access attempts
Baseline camera firmware hashes and configuration state, then alert on deviations
Deploy network detection rules that flag SSH traffic to camera VLANs from non-administrative subnets

Monitoring Recommendations

Forward camera syslog and authentication events to a centralized logging platform for correlation
Enable network flow monitoring on IoT and surveillance VLANs to detect lateral movement originating from cameras
Review privileged operations on cameras (user creation, firmware updates, service restarts) daily

How to Mitigate CVE-2026-57599

Immediate Actions Required

Disable the SSH service on affected Hikvision cameras if it is not required for operations
Rotate all administrative credentials on Hikvision devices and remove shared or default accounts
Restrict management network access to cameras using ACLs or dedicated management VLANs
Apply the vendor-supplied firmware update as soon as it is available for your device model

Patch Information

Hikvision has published a security advisory for this vulnerability. Consult the Hikvision Security Advisory for the specific firmware versions that remediate CVE-2026-57599 and follow the vendor's upgrade procedure for each affected model.

Workarounds

Disable SSH access on cameras where remote shell administration is not required
Place cameras on isolated network segments with no direct internet exposure and strict egress filtering
Enforce strong, unique administrative passwords and enable account lockout policies where supported
Continuously monitor for unauthorized SSH sessions and privileged operations until firmware is patched

bash

# Example: restrict SSH access to camera management subnet using an upstream firewall (iptables)
iptables -A FORWARD -p tcp -s 10.10.20.0/24 -d 10.10.99.0/24 --dport 22 -j ACCEPT
iptables -A FORWARD -p tcp -d 10.10.99.0/24 --dport 22 -j DROP