CVE-2026-85545

Executive Summary

CVE-2026-85545 is an authorization bypass vulnerability in Hikvision HikCentral Access Control, a physical access control management platform. Authenticated users holding low-privilege roles can invoke API interfaces that their assigned role is not authorized to access, enabling unauthorized read access to protected data and limited integrity impact. The flaw carries a CVSS v3.1 base score of 7.1 (High) and currently has no publicly available patch, PoC, or exploit code.

Technical Analysis

The vulnerability is classified as an incorrect authorization / broken access control weakness (most consistent with CWE-863, though no CWE was explicitly assigned in the supplied data). The NVD description states plainly: "Authenticated low-privilege users can invoke API interfaces that their role is not authorized to access." This is a server-side access control failure in which the application does not adequately verify that the requesting principal's role or permission set covers the requested API interface before processing the call.

Key structural facts derivable from the provided data:

• Attack surface: API interfaces exposed by HikCentral Access Control. The mechanism is a role-to-endpoint authorization gap — the endpoint is reachable and processes requests from identities whose role should have been denied.
• Authentication prerequisite: The attacker must already hold valid low-privilege credentials (PR:L in the vector). This is not a pre-auth vulnerability.
• Network reachability: AV:N confirms the API is exploitable over the network; interaction is not required (UI:N) and scope is unchanged (S:U), meaning the impact stays within the same security authority.
• Impact profile: Confidentiality:High, Integrity:Low, Availability:None. The dominant risk is unauthorized disclosure of data accessible through privileged API interfaces, with a secondary, limited ability to modify state through those same interfaces.

No specific API paths, parameter names, function names, or role identifiers are given in the source data. Per accuracy constraints, this report describes the flaw at the vulnerability-class level (broken function-level / role-based authorization on API endpoints) rather than fabricating endpoint names, controllers, or middleware identifiers not present in the description.

In practical terms for this class of bug: the authorization decision is expected to be enforced per-endpoint against the caller's role. The failure mode is that some interfaces either (a) do not perform the role check at all, (b) perform it only at the UI/routing layer and not at the API handler, or (c) rely on client-supplied role or permission parameters. The description does not specify which of these applies, and no exploit artifact exists to disambiguate it.

Exploitation Scenarios

No public PoC exists. The attack chain below is inferred strictly from the vulnerability class (authenticated privilege/authorization bypass on API interfaces) and the stated CVSS metrics. It does not assert specific endpoint names or parameters, which are not present in the source data.

1. Reconnaissance / target identification. The attacker identifies an internet- or intranet-exposed HikCentral Access Control deployment. This is an authenticated scenario, so the attacker requires legitimate low-privilege access — obtained through a contractor/integration account, a shared operator credential, a provisioned read-only user, or credential reuse from another breach. The attacker enumerates the API surface reachable with their low-privilege token.

2. Triggering the flaw. Using their authenticated low-privilege session, the attacker issues requests to API interfaces that the platform should restrict to higher-privileged roles. Because the role-to-endpoint authorization check is ineffective for the affected interfaces, the requests are processed rather than rejected with an authorization error (e.g., a 401/403). The specific request format is not documented in the available data.

3. Execution method (class level). This is a broken-access-control/IDOR-family attack: no memory corruption, injection payload, or authentication bypass is required. The "payload" is simply a well-formed authenticated API call targeting a privileged interface using a token the attacker already legitimately holds. Success is measured by the API returning data or actions a low-privilege role should not obtain.

4. Post-exploitation impact. With Confidentiality:High, the primary gain is unauthorized disclosure of information exposed by privileged interfaces — for a physical access control platform this can plausibly include personnel data, credential/door configuration data, and access-event records, though the description does not enumerate exposed data types. Integrity:Low reflects a limited ability to alter state through the same unauthorized interfaces. Availability is unaffected. Compromise of an access-control management plane is sensitive because it sits adjacent to physical security operations; however, no downstream physical-impact chain is asserted here beyond what the data supports.

Impact Assessment

The CVSS v3.1 base score is 7.1 (High) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N.

• Confidentiality (High): The core impact. Low-privilege users can read data behind privileged API interfaces.
• Integrity (Low): Some unauthorized modification capability through the same interfaces, but bounded.
• Availability (None): No denial-of-service component.
• Exploitability: AC:L (no special conditions) and UI:N (no victim interaction), offset by PR:L (requires a valid low-privilege account). This makes it a realistic insider-risk and lateral-movement risk rather than a mass remote exploit.
• Blast radius: Any organization running affected HikCentral Access Control versions with API access reachable by low-privilege accounts. Because integrations, contractors, and operators commonly hold such accounts on access-control platforms, the pool of potential internal actors is significant.

No EPSS score is available (not yet scored by FIRST.org), no CISA KEV listing, and no exploit-in-the-wild evidence is present in the supplied data. The practical business risk is unauthorized access to sensitive physical-security and personnel data by under-privileged users, plus audit/compliance exposure for environments where access-control data is regulated.

Detection Guidance

Sigma Rule

title: Suspicious Authenticated API Access to Privileged HikCentral Access Control Interfaces
id: 5b1e2c9a-7f4d-4a1b-9c3e-hik202685545
status: experimental
description: Detects low-privilege authenticated principals invoking API interfaces in HikCentral Access Control that their role should not access (CVE-2026-85545 class).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-85545
author: valtersit.com
date: 2026/01/01
logsource:
  category: web
  product: hikvision
detection:
  selection_method:
    cs-method:
      - 'GET'
      - 'POST'
      - 'PUT'
      - 'DELETE'
  selection_api:
    cs-uri-stem|contains:
      - '/api/'
  filter_authorized:
    sc-status:
      - 200
      - 201
  condition: selection_method and selection_api and filter_authorized
fields:
  - c-ip
  - cs-username
  - cs-uri-stem
  - sc-status
falsepositives:
  - Legitimate privileged API calls by authorized admin roles
  - Monitoring or integration accounts with correctly scoped permissions
level: medium
tags:
  - attack.t1190
  - cve.2026.85545

YARA Rule

rule CVE_2026_85545_HikCentral_AuthzBypass_Indicator
{
    meta:
        description = "Heuristic indicator for CVE-2026-85545 HikCentral Access Control authorization bypass artifacts"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-85545"
        date = "2026-01-01"
        severity = "high"

    strings:
        $hc1 = "HikCentral" ascii nocase
        $hc2 = "HikCentral Access Control" ascii nocase
        $api = "/api/" ascii
        $err1 = "role" ascii nocase
        $err2 = "not authorized" ascii nocase
        $err3 = "permission" ascii nocase
        $log = "low-privilege" ascii nocase

    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464C457F
        or (
            $hc1 and any of ($api, $err*) 
        )
        or (
            $hc2 and $log
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-85545 HikCentral Access Control API Authorization Bypass Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/"; nocase; http.header; content:"Authorization"; nocase; threshold: type both, track by_src, count 20, seconds 60; classtype:attempted-recon; reference:cve,2026-85545; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-85545; sid:202685545; rev:1;)

Elastic Detection

sequence by user.id, source.ip with maxspan=5m
  [ network where network.protocol == "http" and http.request.method in ("GET","POST","PUT","DELETE")
      and url.path : "/api/*" ]
  [ network where network.protocol == "http" and http.response.status_code in (200,201)
      and url.path : "/api/*" ]

Splunk SPL Query

index=web (hikvision OR hikcentral)
| search uri_path="/api/*" status IN (200 201)
| stats count min(_time) as first_seen max(_time) as last_seen
        values(uri_path) as endpoints values(status) as statuses
        by src_ip user
| where count > 0
| sort - count
| table first_seen last_seen src_ip user count endpoints statuses

Wazuh OSSEC Rule

<group name="web,hikvision,cve-2026-85545,">
  <rule id="100855" level="10">
    <if_sid>31100</if_sid>
    <match>CVE-2026-85545|HikCentral</match>
    <regex>/api/</regex>
    <description>CVE-2026-85545: Possible HikCentral Access Control API authorization bypass - low-privilege user accessing privileged interface</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>access_control,cve_2026_85545,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version list was available in the supplied data. The following are defensive measures appropriate to the broken-access-control vulnerability class and should be validated against the actual vendor advisory once published.

1. Immediate mitigations

   • Restrict network exposure of the HikCentral Access Control API. Do not expose management/API interfaces directly to the internet; place them behind a VPN or an authenticated reverse proxy with strict ACLs.
   • Audit and minimize low-privilege and integration accounts. Disable unused accounts and tighten role assignments.
   • Apply server-side authorization enforcement at the gateway/proxy layer where possible, rejecting calls to privileged API interfaces from low-privilege identities until a vendor patch is available.
   • Enable detailed API access logging and monitor for authenticated principals reaching interfaces outside their role.

2. Patch / upgrade steps

   • Monitor Hikvision's official security advisory channel for HikCentral Access Control updates addressing CVE-2026-85545.
   • Once a fixed version is published, upgrade promptly and verify the patch notes explicitly reference this CVE.
   • Because no affected-version list is available, inventory all HikCentral Access Control deployments and confirm exact installed versions against the eventual vendor advisory.

3. Long-term hardening

   • Implement least-privilege role design and periodic entitlement reviews for the access-control platform.
   • Adopt server-side, deny-by-default authorization middleware for every API interface, with centralized policy enforcement.
   • Deploy the detection content above and tune for environment-specific false positives.
   • Include physical-security management platforms in vulnerability management and threat-modeling scope.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-85545
• Hikvision Security Advisory portal: https://www.hikvision.com/en/support/cybersecurity/security-advisory/ (verify the specific advisory for CVE-2026-85545 when published)
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• CISA Known Exploited Vulnerabilities Catalog (for KEV status checks): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Note: No threat actor campaign, exploit-in-the-wild evidence, public PoC, or CISA KEV entry is associated with CVE-2026-85545 based on the supplied data. No EPSS score is available. The affected version range is not specified in the source data and must be confirmed against the vendor advisory.