PT-2025-43012 · Hikvision · Hikvision Isecure Center

Published 2025-10-22 · Updated 2025-10-22 · CVE-2023-53691

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center versions through 2023-06-25

Description A directory traversal flaw allows unauthenticated file uploads via the /center/api/files endpoint. This enables attackers to perform directory traversal attacks and upload arbitrary files. This issue has been actively exploited in the wild since 2024 and into 2025. The files directory is vulnerable to traversal attacks.

Recommendations Versions through 2023-06-25 should be updated. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-24

Related Identifiers

CVE-2023-53691

Affected Products

Hikvision Isecure Center

References · 7

• 🔥 https://zhuanlan.zhihu.com/p/639514473 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-53691 · Security Note
• https://twitter.com/CveTodo/status/1980853683874041882 · Twitter Post
• https://t.me/cveNotify/139800 · Telegram Post
• https://twitter.com/CVEnew/status/1980853413945438253 · Twitter Post
• https://t.me/CVEtracker/35447 · Telegram Post
• https://twitter.com/ZeroPathLabs/status/1980855948156514695 · Twitter Post