CVE-2026-85544 identifies an improper encryption configuration vulnerability in Hikvision DS-KV9503 intercom devices. This weakness could enable attackers to forge M1 cards used for authentication or access control. The CVSS 3.1 base score is 5.2, reflecting medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact but limited integrity impact. No remediation level or patch information is currently available, and no known exploits have been reported.

Successful exploitation could allow attackers to create forged M1 cards, potentially bypassing authentication mechanisms and gaining unauthorized access. Confidentiality impact is high, while integrity impact is low and availability impact is none. The vulnerability does not require privileges or user interaction to exploit, increasing risk in exposed environments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until official fixes or mitigations are provided by Hikvision, users should monitor vendor communications and consider restricting physical and network access to vulnerable devices to reduce exposure.