Security Vulnerabilities in some HikCentral Products

Security Vulnerabilities in some HikCentral Products

SN No. HSRC-202508-01

Edit: Hikvision Security Response Center (HSRC)

Initial Release Date: 2025-08-28

 

Summary

(1) There is a CSV Injection Vulnerability of certain HikCentral Master Lite versions. This could allow an attacker to inject executable commands via malicious CSV data.

(2) There is an Unquoted Service Path Vulnerability of certain HikCentral FocSign versions. This could allow an authenticated user to potentially enable escalation of privilege via local access.

(3) There is a network environment Vulnerability of certain HikCentral Professional versions. This could allow an unauthenticated user to gain administrative access to the platform

 

CVE ID

CVE-2025-39245

CVE-2025-39246

CVE-2025-39247

 

Scoring

CVSS v3.1 is adopted in scoring these vulnerabilities

(http://www.first.org/cvss/specification-document

CVE-2025-39245

Base score: 4.7 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L)

CVE-2025-39246

Base score: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVE-2025-39247

Base score: 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N)

 

Affected Versions

Product Name

CVE ID

Affected Versions

HikCentral Master Lite

CVE-2025-39245

Versions between V2.2.1 and V2.3.2

HikCentral FocSign

CVE-2025-39246

Versions between V1.4.0 and V2.2.0

HikCentral Professional

CVE-2025-39247

Versions between V2.3.1 and V2.6.2

Version V3.0.0

Solution and How to Access

  • For all affected baseline version ranges, we recommend upgrading to the latest baseline version (2.6.3 or 3.0.1 onwards), depending on the EU regional software launch plan. These can be downloaded from the EU regional software support page (EU Link below)
    https://www.hikvision.com/uk/support/download/software/

 

 

 

  • CVE-2025-39247_FixPack
    • Size: 31.1MB

      MD5: 95e235f3f84db124dd7dab7223ab4e0a

    Download
    Download

If required, please contact your regional installer, integrator, distributor, local Hikvision support or support.uk@hikvision.com for assistance in implementing the patch. The patch must be installed on the HikCentral Professional central server with administrative permissions.

During patch implementation, a security authorization code will be required. This can be obtained by contacting your local Hikvision support or support.uk@hikvision.com

 

Source of Vulnerability Information

These vulnerabilities were reported to HSRC by Yousef Alfuhaid / Nader Alharbi (joint submission), Eduardo Bido, and Dr. Matthias Lutter.

 

Contact Us

To report any security issues or vulnerabilities in Hikvision products and solutions, please contact Hikvision Security Response Center at hsrc@hikvision.com.

Hikvision would like to thank all security researchers for your attention to our products.

Hikvision.com uses strictly necessary cookies and related technologies to enable the website to function. With your consent, we would also like to use cookies to observe and analyse traffic levels and other metrics / show you targeted advertising / show you advertising on the basis of your location / tailor our website's content. For more information on cookie practices please refer to our cookie policy.

Contact Us
Hik-Partner Pro close
Hik-Partner Pro
Security Business Assistant. At Your Fingertips. Learn more
Hik-Partner Pro
Scan and download the app
Hik-Partner Pro
Hik-Partner Pro

Get a better browsing experience

You are using a web browser we don’t support. Please try one of the following options to have a better experience of our web content.