Loading story…
A high-severity authenticated command execution flaw in Hikvision DS-3WAP series wireless access points, tracked as CVE-2026-0709 (CVSS 7.2), was disclosed as stemming from insufficient input validation in device firmware. An attacker with valid credentials can send specially crafted packets containing malicious commands to trigger arbitrary command execution, enabling device takeover scenarios that can support traffic interception, lateral movement, or disruption of wireless services—particularly if credentials are stolen, default, or obtained via an initial foothold.
Hikvision released patched firmware V1.1.6601 build 251223 to address the issue across affected models running V1.1.6303 build250812 and earlier, including DS-3WAP521-SI, DS-3WAP522-SI, DS-3WAP621E-SI, DS-3WAP622E-SI, DS-3WAP623E-SI, and (per reporting) DS-3WAP622G-SI. Organizations using these access points should prioritize upgrading firmware and reviewing access controls around device administration, as the exploitability hinges on possession of valid credentials and may be used as a second-stage escalation after an initial account compromise.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
Security reports publicly disclosed technical details of CVE-2026-0709, including its CVSS 7.2 rating, affected Hikvision wireless access point models, and the risk of traffic interception, lateral movement, or wireless service disruption after credential compromise. Multiple outlets also highlighted Hikvision's remediation guidance and recommended defensive measures such as stronger access controls and network segmentation.
Hikvision released firmware version V1.1.6601 build251223 to fix CVE-2026-0709 in affected DS-3WAP models running V1.1.6303 build250812 and earlier. The update addresses a high-severity issue that could let an authenticated attacker hijack the device and gain control of its underlying operating system.
An independent researcher known as exzettabyte reported an authenticated command execution vulnerability in Hikvision DS-3WAP wireless access points, later assigned CVE-2026-0709. The flaw stems from insufficient input validation and can allow arbitrary command execution via crafted packets.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
WatchGuard disclosed three vulnerabilities affecting WatchGuard AP firmware versions `1.0` through `3.4.7`, including two critical unauthenticated flaws: `CVE-2026-86102` and `CVE-2026-101891`. Both carry a CVSS v4 score of 9.3 and can allow a network-based attacker to bypass authentication or execute arbitrary operating-system commands through exposed internal API functionality. A third issue, `CVE-2026-87969` (CVSS 8.6), enables authenticated administrators to inject and execute OS commands through crafted diagnostic command-line input. WatchGuard fixed all three vulnerabilities in firmware version `3.4.8`. The company reported no known in-the-wild exploitation or public proof of concept at disclosure, but the unauthenticated network-reachable attack paths make unpatched APs high-risk. Organizations should immediately upgrade affected devices, restrict AP management and API interfaces to trusted administrative networks, and review logs and administrator credentials for signs of unauthorized access.
Sep 29, 2026
Advantech released security updates for **EKI-series industrial wireless access points** after researchers disclosed **20 vulnerabilities**, including **six critical flaws** tracked as `CVE-2024-50370` through `CVE-2024-50375`. The most severe issues affect over-the-air functionality and can let a **remote, unauthenticated attacker** bypass authentication, execute arbitrary code as **root**, and take full control of exposed devices. The affected products are **EKI-6333AC-2G** and **EKI-6333AC-2GD** running firmware earlier than **v1.6.5**, and **EKI-6333AC-1GPO** running firmware earlier than **v1.2.2**. Additional high-severity weaknesses could enable **cross-site scripting**, **system command injection**, **denial of service**, and unauthorized access to sensitive data. Defenders are advised to **immediately upgrade firmware** to the vendor-fixed versions and review internet-exposed or operational technology deployments using these access points.
Jul 24, 2026
Hewlett Packard Enterprise released security updates for **HPE Networking Instant On Access Points** to fix two vulnerabilities affecting firmware version `3.2.0.1` and earlier. The most severe issue, **`CVE-2025-37103`**, is a critical hard-coded credentials flaw with a **CVSS score of 9.8** that could allow a remote attacker to gain administrative access to the device web interface. HPE documented the issues in security bulletin **`HPESBNW04894`** and urged customers to update affected systems. HPE also patched **`CVE-2025-37102`**, a high-severity vulnerability with a **CVSS score of 7.2** that allows a remote authenticated attacker to inject arbitrary commands into the device console and execute commands on the underlying system. The company recommended immediate upgrades to firmware version `3.2.1.0` or later to reduce the risk of unauthorized access and command execution on exposed access points.
Jul 24, 2026