Multi Flaws Found in HikCentral, Including a Bypass for Admin Access (CVE-2025-39247)

According to HSRC, three vulnerabilities affect different HikCentral products, ranging from CSV injection to privilege escalation and a critical access control bypass. CVE-2025-39245 (CVSS 4.7) concerns CSV injection in some HikCentral Master Lite versions, potentially allowing execution of malicious commands via exported CSV data.

CVE-2025-39246 (CVSS 5.3) is an unquoted service path vulnerability in some HikCentral FocSign versions, which could enable privilege escalation with local access for an authenticated user. CVE-2025-39247 (CVSS 8.6) is an access control vulnerability in some HikCentral Professional versions, allowing an unauthenticated user to obtain admin permission and, as the article notes, full administrative takeover.

The advisory also lists impacted versions and fixes: HikCentral Master Lite for CVE-39245 from V2.2.1 to V2.3.2, fixed in V2.4.0; HikCentral FocSign for CVE-39246 from V1.4.0 to V2.2.0, fixed in V2.3.0; HikCentral Professional for CVE-39247 from V2.3.1 to V2.6.2, fixed in V3.0.0, or in V2.6.3 or V3.0.1. The vulnerabilities present different levels of risk, with the most dangerous enabling remote admin rights in HikCentral Professional deployments. The HikCentral role in video management underscores why rapid patching is essential.