Severe Hikvision HikCentral product flaws: What You Need to Know

Security researchers warn of three vulnerabilities in Hikvision HikCentral, a centralised management platform used for video surveillance, access control and security operations. The flaws include CVE-2025-39245 (base score 4.7) in HikCentral Master Lite that could allow CSV injection, CVE-2025-39246 (base score 5.3) in HikCentral FocSign that could enable privilege escalation, and CVE-2025-39247 (base score 8.6) in HikCentral Professional that could let an unauthenticated user obtain admin permission.

One high-severity flaw allows an unauthenticated user to escalate privileges and gain administrative access, creating a direct path to manipulate configurations, tamper with logs or disable monitoring. HikCentral serves as the backbone for many organisations’ security infrastructures, and attackers could take over camera control, door access and data from multiple devices once elevated.

The affected versions and their fixed releases are HikCentral Master Lite (CVE-2025-39245; V2.2.1–V2.3.2; fixed in V2.4.0), HikCentral FocSign (CVE-2025-39246; V1.4.0–V2.2.0; fixed in V2.3.0, or V2.3.0), and HikCentral Professional (CVE-2025-39247; V2.3.1–V2.6.2; fixed in V3.0.0 or V3.0.1). According to Hikvision, administrators should apply updates promptly, harden the environment, check deployment versions, and install the latest patches from the official security bulletin.