PT-2025-43013 · Hikvision · Hikvision Isecure Center

Published 2025-10-22 · Updated 2025-10-22 · CVE-2024-58274

Positive Technologies · (AI Summary)

CVSS v3.1

8.3

8.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center versions through 2024-08-01

Description The software contains a flaw that permits the execution of a command. This occurs through the use of the

$( )

construct within JSON data sent to the

/center/api/installation/detection

API endpoint. This issue was observed being exploited in real-world attacks during 2024 and 2025. The vulnerable parameter is the JSON data sent to the API endpoint.

Recommendations Versions through 2024-08-01 should be updated.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-58274

Affected Products

Hikvision Isecure Center

References · 9

• 🔥 https://xz.aliyun.com/news/14639 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-58274 · Security Note
• https://github.com/ahisec/nuclei-tps/blob/main/http/vulnerabilities/hikvision/hikvision-csmp-installation-rce.yaml · Note
• https://forum.butian.net/article/498 · Note
• https://twitter.com/CVEnew/status/1980853414880837822 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1980869982956253495 · Twitter Post
• https://twitter.com/ZeroPathLabs/status/1980857709797720134 · Twitter Post
• https://t.me/cveNotify/139801 · Telegram Post
• https://t.me/CVEtracker/35448 · Telegram Post