# CVE-2026-85544: Hikvision Intercom main card forgery via immutable factory value

Source: https://junglewise.ai/threats/cve-2026-85544-hikvision-intercom-main-card-forgery-via-immutable-factory-value  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-85544 · Severity: medium · CVSS 6.1 · Published 2026-09-10

Hikvision intercom systems store an immutable factory value on their main cards that is used to validate legitimate access cards. This vulnerability allows attackers to forge valid access cards by obtaining or predicting this factory value, potentially granting unauthorized users the ability to issue additional cards and gain physical access to secured areas protected by these intercoms.

Vendors: [Hikvision](https://junglewise.ai/threats/vendors/hikvision).

## Quick answers

**Is CVE-2026-85544 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85544 being exploited in the wild.

**How severe is CVE-2026-85544?** Medium severity, with a CVSS score of 6.1, published 10 September 2026.

**Which products and versions are affected?** Hikvision Intercom <UNKNOWN>.

**Is there a fix for CVE-2026-85544?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-85544 attacked?** It is attacked with local access or from the adjacent network, in a network appliance.

**Am I affected by CVE-2026-85544?** Check whether you run Hikvision Intercom at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in Hikvision intercom products that rely on an immutable factory value embedded in their main card for access control validation. An attacker who obtains this factory value—either through local network reconnaissance or physical interaction with a device—can forge legitimate main cards and bypass the card validation mechanism. The flaw allows an attacker to issue additional access cards and gain unauthorized permission escalation within the intercom system. No authentication or remote attack vector is required if the attacker has local network or physical access. Patch availability has not been confirmed in the provided advisory details.

## Affected products

- Hikvision Intercom <UNKNOWN>

## Timeline

- 2026-09-10: disclosed

## References

- [https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-some-hikvision-intercom-products](https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-some-hikvision-intercom-products)