Critical Hikvision Vulnerabilities Allow Remote Command Injection

On 28 August 2025, the Hikvision Security Response Center issued Security Advisory SN No. HSRC-202508-01 detailing three critical vulnerabilities across HikCentral products. Collectively assigned CVEs CVE-2025-39245, CVE-2025-39246, and CVE-2025-39247 range from moderate to high severity and could allow attackers to execute unauthorized commands, escalate privileges, or obtain administrative access, with CVSS base scores of 4.7, 5.3 and 8.6 respectively.

The first issue, CVE-2025-39245, is a CSV Injection vulnerability in HikCentral Master Lite versions 2.2.1 through 2.3.2, where malicious CSV data could trigger harmful scripts when opened by spreadsheet applications, and upgrading to Master Lite 2.4.0 neutralises embedded formulas. The second vulnerability, CVE-2025-39246, is an Unquoted Service Path flaw in HikCentral FocSign versions 1.4.0 through 2.2.0; Hikvision has released FocSign 2.3.0 to address this by quoting all service paths.

The most severe, CVE-2025-39247, is an access control bypass in HikCentral Professional versions 2.3.1 through 2.6.2, with unauthenticated remote attackers potentially gaining administrative rights; upgrading to Professional 2.6.3 or 3.0.1 is advised. Details of the affected products and fixes are provided, including contact through Hikvision’s regional support portals and download links for the patched versions.