{"id":141,"date":"2026-08-13T20:59:19","date_gmt":"2026-08-13T10:59:19","guid":{"rendered":"https:\/\/mallen.com.au\/blog\/?p=141"},"modified":"2026-08-13T20:59:19","modified_gmt":"2026-08-13T10:59:19","slug":"cve-2026-61392-hikvision-camera-information-disclosure","status":"publish","type":"post","link":"https:\/\/mallen.com.au\/blog\/cve-2026-61392-hikvision-camera-information-disclosure\/","title":{"rendered":"CVE-2026-61392: Hikvision Camera Information Disclosure"},"content":{"rendered":"\n

A newly published vulnerability, CVE-2026-61392, affects a range of Hikvision camera models and highlights a recurring theme in surveillance security: even without full authentication bypass, an information disclosure flaw can quietly hand attackers useful reconnaissance data. For sites running Hikvision hardware \u2014 directly or via OEM-rebadged products built on Hikvision firmware \u2014 this is worth a look, even though it doesn’t demand emergency action.<\/p>\n\n\n\n

What the vulnerability actually does<\/h2>\n\n\n\n

CVE-2026-61392 is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). In plain terms, an unauthenticated attacker with network access to a camera’s management or media interface can send crafted requests and receive back fragments of the device’s memory \u2014 potentially including session artifacts, configuration data, or other transient runtime information. No credentials and no user interaction are required to trigger it.<\/p>\n\n\n\n

Importantly, this is a partial disclosure, not a full memory dump, and it does not directly affect device integrity or availability. The camera keeps working normally; the risk is what an attacker can do with the leaked fragments. Memory disclosure bugs like this are rarely exploited in isolation \u2014 they’re typically chained with other weaknesses to defeat ASLR protections, harvest stray credentials sitting in buffers, or fingerprint exact firmware versions to target a more serious exploit further down the track.<\/p>\n\n\n\n

Hikvision has published a security advisory listing the specific affected models and firmware versions, along with patched firmware. As is often the case with these advisories, the public write-up doesn’t specify exactly which service or request handler is responsible \u2014 that detail sits in the vendor’s own technical notes.<\/p>\n\n\n\n

Why this matters operationally<\/h2>\n\n\n\n

The practical risk here scales directly with how exposed your cameras are. A camera sitting on a properly segmented surveillance VLAN, with management access restricted to a jump host or VPN gateway, presents a very small attack surface for this kind of flaw \u2014 an external attacker would need to already be inside the network to reach it. A camera with its management interface directly reachable from the internet, or accessible from a general office or guest network, is a different story entirely.<\/p>\n\n\n\n

This is a good moment for facilities and IT managers to check three things:<\/p>\n\n\n\n