An access control vulnerability exists in Hikvision HikCentral Professional versions 2.4.0 to 3.0.1 that may permit an unauthenticated attacker to obtain admin-level permissions. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) reflects a network attack vector with high complexity, no privileges or user interaction required, and a scope change with high confidentiality impact but no integrity or availability impact. No official remediation or patch information is currently available from the vendor.

Successful exploitation allows an unauthenticated attacker to escalate privileges to administrative level, potentially compromising confidentiality of sensitive information managed by HikCentral Professional. There is no reported impact on integrity or availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict network access to HikCentral Professional management interfaces and monitor for unauthorized access attempts. Follow vendor updates closely for any forthcoming patches or mitigation instructions.