Paper/Archive/CVE-2023-28815

CVE-2023-28815

Hikvision iSecure Center — Some versions of Hikvision's iSecure Center Product contain insufficient parameter validation, resulting in a command injection vulnerabi…

EPSS 1%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 72.9.729 × 2014.6 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Some versions of Hikvision's iSecure Center Product contain insufficient parameter validation, resulting in a command injection vulnerability. Attackers may exploit this to gain platform privileges and execute arbitrary commands on the system.iSecure Center is software released for China's domestic market only, with no overseas release.

Affected

ProductAffectedFixed inSource

iSecure CenterV1.0.0 - V1.7.0–CNA

Scores by source

hikvision (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refhikvision.com/cn/support/CybersecurityCenter/SecurityNotices/2023-04