CVE-2026-32683

Some EZVIZ products utilize older versions of cloud feature modules with legacy API interfaces, which pose a data transmission risk. Attackers can exploit this by eavesdropping on network requests to obtain data.Users are advised to upgrade the app to the latest version and enable the video encryption feature.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.ezviz.com/inter/trust-center/security/security-notice/2026.05.08
https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-cloud-function-modules-of-some-hikvisi/

Configurations

No configuration.

History

No history.

Information

Published : 2026-05-09 09:16

Updated : 2026-07-25 11:10

NVD link : CVE-2026-32683

Mitre link : CVE-2026-32683

CVE.ORG link : CVE-2026-32683

JSON object : View

Products Affected

No product.

CWE

CWE-319

Cleartext Transmission of Sensitive Information

{"id": "CVE-2026-32683", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32683", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-11T17:29:08.128087Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "hsrc@hikvision.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.6}]}, "affected": [{"source": "hsrc@hikvision.com", "affectedData": [{"vendor": "EZVIZ", "product": "EZVIZ APP", "versions": [{"status": "affected", "version": "iOS: Versions prior to 7.3.1"}, {"status": "affected", "version": "Android: Versions prior to 7.3.0.0210"}]}]}], "published": "2026-05-09T09:16:08.973", "references": [{"url": "https://www.ezviz.com/inter/trust-center/security/security-notice/2026.05.08", "source": "hsrc@hikvision.com"}, {"url": "https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerability-in-cloud-function-modules-of-some-hikvisi/", "source": "hsrc@hikvision.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-319"}]}], "descriptions": [{"lang": "en", "value": "Some EZVIZ products utilize older versions of cloud feature modules with legacy API interfaces, which pose a data transmission risk. Attackers can exploit this by eavesdropping on network requests to obtain data.Users are advised to upgrade the app to the latest version and enable the video encryption feature."}, {"lang": "es", "value": "Algunos productos EZVIZ utilizan versiones antiguas de m\u00f3dulos de funciones en la nube con interfaces de API heredadas, lo que plantea un riesgo de transmisi\u00f3n de datos. Los atacantes pueden explotar esto al interceptar solicitudes de red para obtener datos. Se aconseja a los usuarios que actualicen la aplicaci\u00f3n a la \u00faltima versi\u00f3n y activen la funci\u00f3n de cifrado de v\u00eddeo."}], "lastModified": "2026-07-25T11:10:00.100", "sourceIdentifier": "hsrc@hikvision.com"}