Security Alert: Hikvision HikCentral Vulnerabilities

September 1, 2025
Posted by: Chernor Jalloh
Categories:

THREAT SUMMARY

Hikvision has officially disclosed three significant vulnerabilities impacting various versions of its HikCentral products (HikCentral Master Lite, FocSign, and Professional).

CVE-2025-39247 (Critical, CVSS 8.6): Affects HikCentral Professional V2.3.1–V2.6.2 and V3.0.0. Allows unauthenticated remote attackers to gain full admin access due to missing authentication checks.

CVE-2025-39246 (CVSS 5.3): Affects FocSign V1.4.0–V2.2.0. Unquoted service path vulnerability.

CVE-2025-39245 (CVSS 4.7): Affects Master Lite V2.2.1–V2.3.2. CSV injection issue.

WHY IT MATTERS: Exploitation of CVE-2025-39247 could allow attackers to control surveillance, access control, and alarm systems, potentially disabling or manipulating critical security infrastructure.

REQUIRED ACTIONS:

Upgrade immediately – Professional → V2.6.3 / V3.0.1; Master Lite → V2.4.0; FocSign → V2.3.0.
Obtain patches via Hikvision Security Response Center (HSRC).
Restrict and monitor network/API access until patched.
Validate fixes with post-patch security testing.

Immediate patching is strongly recommended

National Cybersecurity Coordination Centre Launches Sierra Leone’s National CSIRT and Digital Forensics Lab Freetown, Sierra Leone

14/01/2025

Cybersecurity Awareness Training for Government Ministries: Enhancing Digital Security

10/01/2025

Cyber Awareness School Debate: Uniting 16 Schools for Cybersecurity Education

10/01/2025

Cyber Hour Radio Program

27/07/2024

Workshop on the Budapest Convention

08/06/2024

Global Conference on Cyber Capacity Building

08/06/2024

how can we help you?

NC3 is dedicated to safeguarding your digital world. Our team of experts is here to provide comprehensive cyber security solutions tailored to your needs. Whether you’re a small business, a large corporation, or an individual seeking to enhance your online security.