A flaw in certain Hikvision switch devices permits authenticated users to execute arbitrary system commands. The vulnerability stems from inadequate validation of command payloads that are accepted over the network. If an attacker can supply crafted packets, they can run any code with the privileges of the system account used for authentication, leading to full compromise of the device.

The affected products are Hikvision DS‑3E1310P‑SI, DS‑3E1318P‑SI and DS‑3E1326P‑SI switches. The advisory notes that these models were discontinued in December 2023 and no specific firmware or software version ranges are provided.

The CVSS score of 7.2 indicates a medium‑to‑high severity. Exploitation requires valid credentials, but once authenticated the attacker can perform arbitrary command execution. The EPSS score of < 1% implies a very low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog, suggesting no current evidence of widespread exploitation. The attack vector is inferred to be remote over the network, and the flaw is a classic command‑injection weakness.