A newly published vulnerability, CVE-2026-61392, affects a range of Hikvision camera models and highlights a recurring theme in surveillance security: even without full authentication bypass, an information disclosure flaw can quietly hand attackers useful reconnaissance data. For sites running Hikvision hardware — directly or via OEM-rebadged products built on Hikvision firmware — this is worth a look, even though it doesn’t demand emergency action.
What the vulnerability actually does
CVE-2026-61392 is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). In plain terms, an unauthenticated attacker with network access to a camera’s management or media interface can send crafted requests and receive back fragments of the device’s memory — potentially including session artifacts, configuration data, or other transient runtime information. No credentials and no user interaction are required to trigger it.
Importantly, this is a partial disclosure, not a full memory dump, and it does not directly affect device integrity or availability. The camera keeps working normally; the risk is what an attacker can do with the leaked fragments. Memory disclosure bugs like this are rarely exploited in isolation — they’re typically chained with other weaknesses to defeat ASLR protections, harvest stray credentials sitting in buffers, or fingerprint exact firmware versions to target a more serious exploit further down the track.
Hikvision has published a security advisory listing the specific affected models and firmware versions, along with patched firmware. As is often the case with these advisories, the public write-up doesn’t specify exactly which service or request handler is responsible — that detail sits in the vendor’s own technical notes.
Why this matters operationally
The practical risk here scales directly with how exposed your cameras are. A camera sitting on a properly segmented surveillance VLAN, with management access restricted to a jump host or VPN gateway, presents a very small attack surface for this kind of flaw — an external attacker would need to already be inside the network to reach it. A camera with its management interface directly reachable from the internet, or accessible from a general office or guest network, is a different story entirely.
This is a good moment for facilities and IT managers to check three things:
- Do you actually know which Hikvision (or Hikvision-OEM) camera models and firmware versions are deployed on site?
- Are any of those management interfaces reachable from outside a dedicated camera/surveillance VLAN?
- Is there a process to apply vendor firmware updates on a reasonable cadence, rather than “whenever someone notices”?
If the answer to the first question is “not sure,” that’s the more pressing problem — you can’t patch or isolate what you haven’t inventoried. A current device register, mapped against firmware versions, is the starting point for responding to advisories like this one efficiently rather than scrambling site-by-site each time a new CVE lands.
Mallen’s take
This advisory doesn’t warrant an emergency truck roll. It’s not remotely code-execution-grade, and Hikvision has already shipped patched firmware for the affected models. But it’s a textbook reminder of why network segmentation matters more than any single patch. Cameras, wherever possible, should sit on an isolated VLAN with no direct inbound path from the internet or general user networks, with switch and firewall ACLs restricting management traffic to designated admin hosts. Where a reverse proxy or VPN gateway is already in front of camera services, that’s a solid mitigating control while firmware updates are scheduled through normal change windows.
For sites that haven’t had a device and firmware audit recently, this kind of routine-but-real disclosure is a reasonable trigger to schedule one. The Mallen site audit covers exactly this — building an accurate device register, mapping network topology, and confirming CCTV coverage and segmentation are still matched to current risk. If you’d rather have someone else own ongoing patch tracking and VLAN hygiene across a camera estate, that’s part of our CCTV and video analytics service scope as well.
Original source: https://www.sentinelone.com/vulnerability-database/cve-2026-61392/