Threat database

Some versions of Hikvision's iSecure Center Product contain insufficient parameter validation, resulting in a command injection vulnerability. Attackers may exploit this to gain platform privileges and execute arbitrary commands on the system.iSecure Center is software released for China's domestic market only, with no overseas release.

EPSS 1.4%VulnerabilityHikvisionGermanyFrance+3

Some versions of Hikvision's iSecure Center Product have an improper file upload control vulnerability. Due to the improper verification of file to be uploaded, attackers may upload malicious files to the server.iSecure Center is software released for China's domestic market only, with no overseas release.

EPSS 0.5%VulnerabilityHikvisionGermanyFrance+4

There is an Access Control Vulnerability in some HikCentral Professional versions. This could allow an unauthenticated user to obtain the admin permission.

EPSS 0.5%VulnerabilityHikvisionGermanyFrance+8

There is an Unquoted Service Path Vulnerability in some HikCentral FocSign versions. This could allow an authenticated user to potentially enable escalation of privilege via local access.

EPSS 0.3%VulnerabilityHikvisionGermanyFrance+8

There is a CSV Injection Vulnerability in some HikCentral Master Lite versions. This could allow an attacker to inject executable commands via malicious CSV data.

EPSS 0.4%VulnerabilityHikvisionGermanyFrance+8

An unauthenticated remote command execution vulnerability exists in the applyCT component of the Hikvision Integrated Security Management Platform due to the use of a vulnerable version of the Fastjson library. The endpoint /bic/ssoService/v1/applyCT deserializes untrusted user input, allowing an attacker to trigger Fastjson's auto-type feature to load arbitrary Java classes. By referencing a malicious class via an LDAP URL, an attacker can achieve remote code execution on the underlying system. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.

Hikvision Streaming Media Management Server v2.3.5 uses default credentials that allow remote attackers to authenticate and access restricted functionality. After authenticating with these credentials, an attacker can exploit an arbitrary file read vulnerability in the /systemLog/downFile.php endpoint via directory traversal in the fileName parameter. This exploit chain can enable unauthorized access to sensitive system files.

Some Hikvision Wireless Access Point are vulnerable to authenticated remote command execution due to insufficient input validation. Attackers with valid credentials can exploit this flaw by sending crafted packets containing malicious commands to affected devices, leading to arbitrary command execution.

EPSS 1.4%VulnerabilityHikvisionGermanyFrance+8

CVE-2021-36260 is a command injection vulnerability affecting the web server component of certain Hikvision security cameras. The flaw arises from insufficient input validation, allowing attackers to execute arbitrary commands on the affected device. This vulnerability has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information is provided in the available data.