The vulnerability lies in the Hik-Connect APP’s inadequate enforcement of directory access permissions, allowing malicious applications on the same device to read files that should be protected. This flaw could lead to disclosure of confidential data stored by the application, affecting the confidentiality of the information but not its integrity or availability. The vulnerability is an example of improper access control that risks data exposure.

The affected product is the Hikvision Hik-Connect APP. No specific version information is disclosed; therefore any current or prior releases of this application may be susceptible until a fix is applied.

The CVSS score of 2.9 reflects a low overall severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, indicating a relatively low exploitation probability. The likely attack vector requires that an adversary have the ability to install a malicious application on the same device or otherwise gain several local access privileges. While the risk of data exposure exists, the requirement for a local foothold makes immediate widespread exploitation less probable, yet the potential impact on confidentiality warrants proactive assessment and remediation.