Products
Smart Hybrid Light
NVR 5.0
2nd Generation Professional Access Control
Commercial Displays
Hik-Partner Pro
Solutions
Retail
Traffic
Perimeter Protection
Europe - EN
Commercial Display
X
Products
Smart Hybrid Light
NVR 5.0
2nd Generation Professional Access Control
Commercial Displays
Hik-Partner Pro
Solutions
Retail
Traffic
Perimeter Protection

Security Vulnerabilities in some HikCentral Products

 

    Security Vulnerabilities in some HikCentral Products

    SN No. HSRC-202508-01

    Edit: Hikvision Security Response Center (HSRC)

    Initial Release Date: 2025-08-28

     

    Summary

    (1) There is a CSV Injection Vulnerability in some HikCentral Master Lite versions. This could allow an attacker to inject executable commands via malicious CSV data.

    (2) There is an Unquoted Service Path Vulnerability in some HikCentral FocSign versions. This could allow an authenticated user to potentially enable escalation of privilege via local access.

    (3) There is an Access Control Vulnerability in some HikCentral Professional versions. This could allow an unauthenticated user to obtain the admin permission.

     

    CVE ID

    CVE-2025-39245

    CVE-2025-39246

    CVE-2025-39247

     

    Scoring

    CVSS v3.1 is adopted in scoring these vulnerabilities

    (http://www.first.org/cvss/specification-document）

    CVE-2025-39245

    Base score: 4.7 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L)

    CVE-2025-39246

    Base score: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

    CVE-2025-39247

    Base score: 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)

     

    Affected Versions and Fix

    Product Name

    CVE ID

    Affected Versions

    Fixed Version

    HikCentral Master Lite

    CVE-2025-39245

    Versions between V2.2.1 and V2.3.2

    V2.4.0

    HikCentral FocSign

    CVE-2025-39246

    Versions between V1.4.0 and V2.2.0

    V2.3.0

    HikCentral Professional

    CVE-2025-39247

    Versions between V2.3.1 and V2.6.2

    Version V3.0.0

    		 V2.6.3 or V3.0.1

    Obtaining Fixed Version

    Contact the local technical support team (click to select a country or region and check the detail technical service) to get the support.

     

    Source of Vulnerability Information

    These vulnerabilities were reported to HSRC by Yousef Alfuhaid / Nader Alharbi (joint submission), Eduardo Bido, and Dr. Matthias Lutter.

     

    Contact Us

    To report any security issues or vulnerabilities in Hikvision products and solutions, please contact Hikvision Security Response Center at hsrc@hikvision.com.

    Hikvision would like to thank all security researchers for your attention to our products.

    Hikvision.com uses strictly necessary cookies and related technologies to enable the website to function. With your consent, we would also like to use cookies to observe and analyse traffic levels and other metrics / show you targeted advertising / show you advertising on the basis of your location / tailor our website's content. For more information on cookie practices please refer to our cookie policy.

    Manage cookies Reject All Accept All
    Accept All
    Reject All Manage cookies
    Sales
    Technical Support
    Newsletter Subscription
    Online Service
    Where to Buy
    Website Feedback
    Contact Us
    Hik-Partner Pro close
    Hik-Partner Pro
    Security Business Assistant. At Your Fingertips. Learn more
    Hik-Partner Pro
    Scan and download the app
    Download
    Hik-Partner Pro
    Hik-Partner Pro

    Get a better browsing experience

    You are using a web browser we don’t support. Please try one of the following options to have a better experience of our web content.