CVE-2024-29949

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-02 · updated 2026-06-17
Weakness: CWE-77

Description

There is a command injection vulnerability in some Hikvision NVRs. This could allow an authenticated user with administrative rights to execute arbitrary commands.

Affected products

Hikvision Ds-7604Ni-K1/4P(B): through V4.30.096build221220
Hikvision Ds-7604Ni-M1/4P: from 5.00.000 before 5.01.070 — fixed in 5.01.070
Hikvision DS-76xxNI-Mx: from V5.00.000 before V5.02.006 — fixed in V5.02.006
Hikvision Ds-76Xxnxi-Lx: from 5.00.000 before 5.02.006 — fixed in 5.02.006
Hikvision DS-77xxNI-Mx: from 5.00.000 before 5.02.006 — fixed in 5.02.006
Hikvision Ds-77Xxnxi-Lx: from 5.00.000 before 5.02.006 — fixed in 5.02.006
Hikvision Ds-86Xxnxi-Lx: from 5.00.000 before 5.02.006 — fixed in 5.02.006
Hikvision Ds-96Xxnxi-Lx: from 5.00.000 before 5.02.006 — fixed in 5.02.006
Hikvision DS-96xxxNI-Mxx: from 5.00.000 before 5.02.006 — fixed in 5.02.006
Hikvision iDS-76xxNXI-Mx: from 5.00.000 before 5.02.006 — fixed in 5.02.006
Hikvision iDS-77xxNXI-Mx: from 5.00.000 before 5.02.006 — fixed in 5.02.006
Hikvision iDS-96xxxMXI-Mxx: from 5.00.000 before 5.02.006 — fixed in 5.02.006

How to fix

Upgrade to a fixed version: Hikvision Ds-7604Ni-M1/4P 5.01.070; Hikvision DS-76xxNI-Mx V5.02.006; Hikvision Ds-76Xxnxi-Lx 5.02.006; Hikvision DS-77xxNI-Mx 5.02.006; Hikvision Ds-77Xxnxi-Lx 5.02.006; Hikvision Ds-86Xxnxi-Lx 5.02.006; Hikvision Ds-96Xxnxi-Lx 5.02.006; Hikvision DS-96xxxNI-Mxx 5.02.006; Hikvision iDS-76xxNXI-Mx 5.02.006; Hikvision iDS-77xxNXI-Mx 5.02.006; Hikvision iDS-96xxxMXI-Mxx 5.02.006. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-29949 or the next vulnerability affects your stack