Paper/Archive/CVE-2023-28814

CVE-2023-28814

Hikvision iSecure Center — Some versions of Hikvision's iSecure Center Product have an improper file upload control vulnerability.

EPSS 0.5%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 43.0.430 × 208.6 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Some versions of Hikvision's iSecure Center Product have an improper file upload control vulnerability. Due to the improper verification of file to be uploaded, attackers may upload malicious files to the server. iSecure Center is software released for China's domestic market only, with no overseas release.

Affected

ProductAffectedFixed inSource

iSecure CenterV1.0.0 - V1.7.0–CNA

Scores by source

hikvision (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refhikvision.com/cn/support/CybersecurityCenter/SecurityNotices/2023-03