{"id":24542,"date":"2026-11-12T21:20:38","date_gmt":"2026-11-12T18:20:38","guid":{"rendered":"https:\/\/azeidkgroup.com\/sa\/media-center\/"},"modified":"2026-11-12T21:21:40","modified_gmt":"2026-11-12T18:21:40","slug":"nca-hikvision-hikcentral-access-control-alert-news-en","status":"publish","type":"post","link":"https:\/\/azeidkgroup.com\/en\/sa\/media-center\/nca-hikvision-hikcentral-access-control-alert-news-en\/","title":{"rendered":"Saudi NCA Warns of High-Severity Flaw in Hikvision HikCentral Access Control"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"24542\" class=\"elementor elementor-24542 elementor-24541 elementor-bc-flex-widget\" data-elementor-post-type=\"post\">\n\t\t\t\t<div class=\"elementor-element elementor-element-ceee694 e-con-full az-el-article e-flex e-con e-parent\" data-id=\"ceee694\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t<div class=\"elementor-element elementor-element-ac5c825 elementor-widget elementor-widget-text-editor\" data-id=\"ac5c825\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"azn-head\"><div class=\"azn-brand\"><span class=\"azn-tag\">AZEIDK Intelligence<\/span><span class=\"azn-line\">We track the change before it reaches your site<\/span><\/div><div class=\"azn-meta\"><span>Regulations &amp; Authorities<\/span><span>National Cybersecurity Authority (NCA)<\/span><\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-4fb1ef0 elementor-widget elementor-widget-text-editor\" data-id=\"4fb1ef0\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p class=\"az-intro\">On 10 September 2026, the CERT team of Saudi Arabia&#8217;s National Cybersecurity Authority (NCA) issued alert No. 2026-7835, titled &#8220;Hikvision Alert&#8221;, with a severity rating of High. It concerns a <strong>Hikvision HikCentral vulnerability<\/strong> in HikCentral Access Control, Hikvision&#8217;s platform for managing access control systems. The NCA recommends updating affected products following the manufacturer&#8217;s guidance.<\/p>\n<p>The CVE record for the flaw, CVE-2026-85545, was published the same day and sets out the affected versions and the nature of the weakness. Below we report only what the official sources say, then explain what it means for Saudi sites that run their doors and gates through this platform.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-f0380ce elementor-widget elementor-widget-text-editor\" data-id=\"f0380ce\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"az-keybox\"><h2>Key takeaways<\/h2><ul><li>NCA alert No. 2026-7835 was issued on 10 September 2026 with a High severity rating.<\/li><li>CVE-2026-85545 lists HikCentral Access Control V2.5.0 and earlier as affected.<\/li><li>The flaw: an authenticated low-privilege user can call API interfaces their role is not authorized to use. It scores 7.1 (High) under CVSS 3.1.<\/li><li>The NCA advises reviewing Hikvision&#8217;s security advisory and updating affected products through the link the vendor published.<\/li><li>The sources we reviewed do not state the fixed version, so take the correct version from Hikvision&#8217;s own advisory.<\/li><\/ul><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-3dd65f5 elementor-widget elementor-widget-text-editor\" data-id=\"3dd65f5\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>What do the NCA alert and the CVE record say?<\/h2>\n<p>The NCA alert, in both its Arabic and English versions, states that Hikvision has released security updates to fix a vulnerability in its products, and links to Hikvision&#8217;s support page for the HikCentral Access Control vulnerability. It lists the targeted sectors as energy, media, manufacturing, healthcare, transportation, water and utilities, commercial facilities and defence. The alert does not give version numbers or the CVE ID; those details are in the CVE record.<\/p>\n<p>CVE-2026-85545 was published on 10 September 2026 with Hikvision as the assigning CNA. OpenCVE describes it as follows:<\/p>\n<div class=\"az-table-wrap\"><table><thead><tr><th>Item<\/th><th>What the record states<\/th><\/tr><\/thead><tbody><tr><td>Product<\/td><td>Hikvision HikCentral Access Control<\/td><\/tr><tr><td>Affected versions<\/td><td>V2.5.0 and earlier<\/td><\/tr><tr><td>Weakness<\/td><td>An authenticated low-privilege user can call API interfaces their role is not allowed to access<\/td><\/tr><tr><td>Classification<\/td><td>CWE-284 (Improper Access Control) and CWE-285 (Improper Authorization)<\/td><\/tr><tr><td>Score<\/td><td>CVSS 3.1: 7.1 (High); network attack, low privileges required, no user interaction<\/td><\/tr><tr><td>Fixed version<\/td><td>Not stated in the sources we reviewed; check Hikvision&#8217;s advisory<\/td><\/tr><\/tbody><\/table><\/div>\n<p>In practice, the risk does not come from an unknown outsider. It comes from an account that already exists on the platform with limited rights, such as a reception or security operator login. The score indicates a high impact on confidentiality and a low impact on integrity.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-50edbb7 elementor-widget elementor-widget-text-editor\" data-id=\"50edbb7\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h2>What does this mean for Saudi Arabia?<\/h2>\n<p>HikCentral Access Control is used to manage door controllers, face and fingerprint terminals and gates from one screen. It usually holds employee and visitor records, entry and exit logs and access schedules. The sectors named in the alert, such as healthcare, manufacturing, energy and commercial facilities, are the same ones that rely on this kind of system at entrances and restricted areas.<\/p>\n<p>The alert does not mention any incident in the Kingdom; its purpose is prevention. Because the flaw sits in the central software rather than in the field devices, a site can stay exposed even when its locks and terminals work normally. It is good practice for the IT manager to record when the alert was reviewed and what action was taken.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-0a7ba0f elementor-widget elementor-widget-text-editor\" data-id=\"0a7ba0f\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"azn-take\"><h2>AZEIDK Expert Take<\/h2><p>If your site manages doors or gates through HikCentral Access Control, start with four steps. First, check the installed version with your system administrator or in the platform interface; V2.5.0 or earlier falls within the CVE record. Second, open Hikvision&#8217;s advisory from the link the NCA referenced and update to the version Hikvision specifies, after backing up the database and scheduling the update so it does not disrupt entrance operation. Third, until the update is complete, restrict access to the platform server so it is not reachable from the internet, review user accounts, remove unused ones, and cut low-privilege roles down to what each role actually needs. Fourth, monitor platform logs and API requests for unusual activity from limited accounts. These interim steps are general good practice, not part of the alert text.<\/p><p>AZEIDK supplies <a href=\"\/en\/brand\/hikvision\/\">Hikvision<\/a> access control devices as part of its <a href=\"\/en\/sa\/solutions\/security-surveillance-systems\/\">security and surveillance systems<\/a>, and offers a <a href=\"\/en\/sa\/services\/programming-systems-integration\/\">programming and systems integration<\/a> service to configure devices and connect them to the platform after the update. For the reader and credential options available, see our guide to <a href=\"\/en\/sa\/media-center\/access-control-technologies\/\">access control technologies<\/a>, and on why firmware should come from the official source, see the news item on <a href=\"\/en\/sa\/media-center\/zkteco-unauthorized-website-warning-news-en\/\">ZKTeco&#8217;s warning about an unauthorized website<\/a>. For questions about Hikvision devices on your site, <a href=\"\/en\/sa\/contact\/\">talk to the AZEIDK team<\/a>.<\/p><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-7cdc5fe elementor-widget elementor-widget-text-editor\" data-id=\"7cdc5fe\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"azn-sources\"><h2>Sources<\/h2><ol><li><a href=\"https:\/\/nca.gov.sa\/en\/cert\/7959\/\" rel=\"nofollow noopener\" target=\"_blank\">Hikvision Alert, No. 2026-7835<\/a>, National Cybersecurity Authority, 10 September 2026<\/li><li><a href=\"https:\/\/nca.gov.sa\/ar\/cert\/7959\/\" rel=\"nofollow noopener\" target=\"_blank\">\u062a\u0646\u0628\u064a\u0647 Hikvision, No. 2026-7835 (in Arabic)<\/a>, National Cybersecurity Authority, 10 September 2026<\/li><li><a href=\"https:\/\/app.opencve.io\/cve\/CVE-2026-85545\" rel=\"nofollow noopener\" target=\"_blank\">CVE-2026-85545: HikCentral Access Control<\/a>, OpenCVE (record assigned by Hikvision), 10 September 2026<\/li><li><a href=\"https:\/\/www.hikvision.com\/en\/support\/cybersecurity\/security-advisory\/security-vulnerability-in-hikcentral-access-control\/\" rel=\"nofollow noopener\" target=\"_blank\">Security Vulnerability in HikCentral Access Control<\/a>, Hikvision, the advisory referenced by the NCA alert<\/li><\/ol><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>Hikvision HikCentral vulnerability: on 10 Sep 2026 Saudi NCA flagged a High-severity flaw in HikCentral Access Control V2.5.0 and earlier. Update now.<\/p>\n","protected":false},"author":0,"featured_media":24538,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[258],"tags":[],"azeidk_region":[223],"class_list":["post-24542","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"acf":[],"_links":{"self":[{"href":"https:\/\/azeidkgroup.com\/en\/wp-json\/wp\/v2\/posts\/24542","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/azeidkgroup.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/azeidkgroup.com\/en\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/azeidkgroup.com\/en\/wp-json\/wp\/v2\/comments?post=24542"}],"version-history":[{"count":1,"href":"https:\/\/azeidkgroup.com\/en\/wp-json\/wp\/v2\/posts\/24542\/revisions"}],"predecessor-version":[{"id":24555,"href":"https:\/\/azeidkgroup.com\/en\/wp-json\/wp\/v2\/posts\/24542\/revisions\/24555"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/azeidkgroup.com\/en\/wp-json\/wp\/v2\/media\/24538"}],"wp:attachment":[{"href":"https:\/\/azeidkgroup.com\/en\/wp-json\/wp\/v2\/media?parent=24542"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/azeidkgroup.com\/en\/wp-json\/wp\/v2\/categories?post=24542"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/azeidkgroup.com\/en\/wp-json\/wp\/v2\/tags?post=24542"},{"taxonomy":"azeidk_region","embeddable":true,"href":"https:\/\/azeidkgroup.com\/en\/wp-json\/wp\/v2\/azeidk_region?post=24542"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}