PT-2025-43013 · Hikvision · Hikvision Isecure Center

Publicado 2025-10-22 · Atualizado 2025-10-22 · CVE-2024-58274

Positive Technologies (AI Summary)

CVSS v3.1

8.3

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center versions through 2024-08-01

Description The software contains a flaw that permits the execution of a command. This occurs through the use of the $( ) construct within JSON data sent to the /center/api/installation/detection API endpoint. This issue was observed being exploited in real-world attacks during 2024 and 2025. The vulnerable parameter is the JSON data sent to the API endpoint.

Recommendations Versions through 2024-08-01 should be updated.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2024-58274

Produtos afetados

Hikvision Isecure Center

Referências · 9

• 🔥 https://xz.aliyun.com/news/14639 · Exploit
• https://github.com/ahisec/nuclei-tps/blob/main/http/vulnerabilities/hikvision/hikvision-csmp-installation-rce.yaml · Nota
• https://t.me/cveNotify/139801 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/1980869982956253495 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2024-58274 · Nota de Segurança
• https://twitter.com/CVEnew/status/1980853414880837822 · Publicação no Twitter
• https://t.me/CVEtracker/35448 · Publicação no Telegram
• https://twitter.com/ZeroPathLabs/status/1980857709797720134 · Publicação no Twitter
• https://forum.butian.net/article/498 · Nota