Hikvision disclosed three separate security vulnerabilities on 10 September 2026: one in IP intercom door stations, one in HikCentral Access Control software, and one in Wi-Fi network cameras. Fixed firmware and software are already available for all three, and Hikvision has stated it is not aware of any active exploitation or public exploit code. None of this is an emergency, but each item represents exactly the kind of published, patchable vulnerability that insurers and procurement teams ask about months after the fact — so it’s worth working through methodically rather than ignoring it.
What was disclosed, and in what order to tackle it
The three vulnerabilities are unrelated and each needs its own fix applied separately:
- CVE-2026-85545 — HikCentral Access Control (CVSS 7.1): affects version 2.5.0 and below. A signed-in user with a low-privilege role can reach functions their role was never meant to expose. Fixed in version 2.5.1.
- CVE-2026-85544 — IP intercom door stations (CVSS 5.2): affects 13 named door station models. A weakness in card encryption handling allows an attacker physically at the panel to forge an M1 (Mifare Classic) entry card. Fixed firmware is available per model.
- CVE-2026-85543 — Wi-Fi network cameras (CVSS 4.3): a signed-in low-privilege user can read the camera’s Wi-Fi configuration through an interface that should not expose it. Fixed in firmware V5.7.26.
The severity score alone doesn’t tell you the right order to work through these. CVE-2026-85545 is the only one reachable remotely over the network by someone who never needs to set foot on site — that makes it the priority, regardless of the other two having lower-but-still-relevant scores. The intercom and camera vulnerabilities both require an attacker to already be physically present at the device, or already have a valid login — meaningfully different risk profiles to a remotely exploitable access control flaw.
Operational implications for Australian sites
For HikCentral Access Control, the real exposure isn’t the vulnerability itself — it’s how many accounts with low-privilege roles are still active on a given install. Reception staff, former contractors, HR users set up years ago and never removed. A permissions escalation flaw is far less useful to an attacker against a system with a clean, current user list. Any patching cycle for this advisory is a good trigger to audit active accounts and roles at the same time.
For the intercom door stations, there’s a worthwhile detail buried in Hikvision’s advisory: door stations with the M1 Card Encryption feature already enabled are not affected by CVE-2026-85544 at all. That’s worth checking before scheduling any site visits — if a site was commissioned with encryption switched on, the urgency drops considerably. If it wasn’t, that’s a second, longer-standing issue worth addressing regardless of this specific CVE, since unencrypted M1/Mifare Classic cards have been cloneable for years independent of this vulnerability. Either way, loading the patched firmware at the next scheduled service visit is sound practice — a configuration setting can be changed by someone else later; patched firmware stays patched.
For the Wi-Fi camera vulnerability, the affected firmware release note names a long list of camera models, but only those with a Wi-Fi radio are actually exposed to this particular flaw — wired-only cameras have no Wi-Fi configuration to leak. It’s still sensible to roll the firmware update across the fleet at the next visit regardless, since the same release also addresses unrelated reliability issues with cameras dropping offline.
Mallen’s take
None of these three require an emergency callout. Two of them need an attacker who already has physical access or a valid login — that’s a materially different risk to something exploitable cold, from off-site. But “no active exploitation” doesn’t mean “ignore it.” A disclosed CVE with a published fix sitting unpatched is the sort of thing that surfaces in an insurance questionnaire or a tender compliance check long after the actual security risk has become academic.
For sites running HikCentral Access Control or any of the named Hikvision intercom or Wi-Fi camera models, we’d recommend prioritising the HikCentral update first, checking M1 encryption settings on intercom door stations before committing to site visits, and rolling camera firmware updates into the next scheduled maintenance window. This is also a good moment to review who actually holds active accounts on your access control platform — a stale user list is a bigger practical risk than most CVEs. If your site doesn’t have a current device and firmware register, the Mallen site audit is a straightforward way to establish one before the next advisory lands.
For sites with Hikvision access control or intercom hardware, our access control and visitor management team can confirm which models and firmware versions are in scope and schedule the updates as part of routine maintenance.
Original source: https://www.ertech.co.uk/hikvision-security-vulnerabilities-september-2026/