CVE-2026-22623

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-30 · updated 2026-06-17
Weakness: CWE-77

Description

Due to insufficient input parameter validation on the interface, authenticated users of certain HIKSEMI NAS products can execute arbitrary commands on the device by crafting specific messages.

Affected products

HIKSEMI HS-AFS-S1H1: V5.10.10_Build_251126

References

https://www.hiksemitech.com/en/hiksemi/support/security-advisory.html

Get alerted when CVE-2026-22623 or the next vulnerability affects your stack