918博天堂·(中国区)首页

Commercial Display

Security Vulnerabilities in HikCentral Product Series

Security Vulnerabilities in HikCentral Product Series

SN No. HSRC-202410-01

Edit: Hikvision Security Response Center (HSRC)

Initial Release Date: 2024-10-18

 

Summary

(1) There is a CSV injection vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could build malicious data to generate executable commands in the CSV file.

(2) There is an XSS vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could inject scripts into certain pages by building malicious data.

(3) There is a SQL injection vulnerability in some HikCentral Professional versions. This could allow an authenticated user to execute arbitrary SQL queries.

 

CVE ID

CVE-2024-47485

CVE-2024-47486

CVE-2024-47487

 

Scoring

CVSS v4.0 is adopted in scoring these vulnerabilities

(http://www.first.org/cvss/v4.0/specification-document)

CVE-2024-47485

Base score: 5.5 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H)

CVE-2024-47486

Base score: 2.1 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N)

CVE-2024-47487

Base score: 7.2 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L)

 

Affected Versions and Fix

Product Name

CVE ID

Affected Versions

Fixed Version

HikCentral Master Lite

CVE-2024-47485

Versions between V2.0.0 and V2.2.1

V2.3.0

HikCentral Master Lite

CVE-2024-47486

Versions below V2.2.1 (including V2.2.1)

V2.3.0

HikCentral Professional

CVE-2024-47487

Versions between V2.0.0 and V2.6.0

V2.6.1

Obtaining Fixed Version

Contact the local technical support team (click to select a country or region and check the detail technical service) to get the support.

 

Source of Vulnerability Information

These vulnerabilities were reported to HSRC by Yousef Alfuhaid and Manh Doan Duc.

 

Contact Us

To report any security issues or vulnerabilities in Hikvision products and solutions, please contact Hikvision Security Response Center at hsrc@hrbaojie.com.

 

Hikvision would like to thank all security researchers for your attention to our products.

 

Contact Us
Hik-Partner Pro close
Hik-Partner Pro
Hik-Partner Pro
Scan and download the app
Download
Hik-Partner Pro
Hik-Partner Pro

Get a better browsing experience

You are using a web browser we don’t support. Please try one of the following options to have a better experience of our web content.