This vulnerability in Hikvision HikCentral Access Control permits authenticated users with low privileges to invoke API interfaces that their assigned roles should not authorize. The CVSS 3.1 score is 7.1, indicating a high severity with network attack vector, low attack complexity, and no user interaction required. The impact is primarily on confidentiality (high) and integrity (low), with no availability impact. No remediation level or patch information is currently available, and no known exploits are reported in the wild.

An attacker with low-privilege authenticated access can gain unauthorized access to API interfaces, potentially exposing sensitive information (high confidentiality impact) and causing limited integrity issues. There is no reported impact on system availability. This could lead to unauthorized data disclosure or limited unauthorized modifications within the HikCentral Access Control system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the HikCentral Access Control system to trusted users only and monitor for unusual API usage patterns consistent with privilege escalation attempts.