CVE-2026-3828 is an authenticated remote command execution vulnerability in Hikvision DS-3E1310P-SI switch products caused by insufficient input validation. Attackers with valid credentials can send crafted packets containing malicious commands to the affected devices, resulting in arbitrary command execution. The vulnerability impacts versions up to and including V1.2.4_210623. The product line has been discontinued since December 2023. The CVSS v3.1 score is 7.2, reflecting high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently provided.

Successful exploitation allows an attacker with valid credentials to execute arbitrary commands on affected Hikvision switch devices, potentially compromising device confidentiality, integrity, and availability. This could lead to full control over the device functions. Since the devices are discontinued, ongoing support and patching may be limited. No public exploits are known at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the affected products are discontinued and no official fix is currently documented, organizations should consider mitigating risk by restricting access to device management interfaces, enforcing strong credential policies, and monitoring for unauthorized access. Replacement of affected hardware with supported models is recommended when feasible.