9.8Critical

CVE-2023-28814

Hikvision iSecure Center Published: 2025-10-17 14:07 (1 year ago)

Description

Some versions of Hikvision's iSecure Center Product have an improper file upload control vulnerability. Due to the improper verification of file to be uploaded, attackers may upload malicious files to the server. iSecure Center is software released for China's domestic market only, with no overseas release.

Weakness (CWE): CWE-434

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
Hikvision	iSecure Center	V1.0.0 - V1.7.0

References and patches

https://www.hikvision.com/cn/support/CybersecurityCenter/SecurityNotices/2023-03/

CVSS score

9.8Critical

Source: hikvision · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

All scores (2)

cna	CVSS 3.1	9.8Critical
hsrc@hikvision.com	CVSS 3.1	9.8Critical

EPSS (chance of exploitation in 30 days)

0.50%

higher than 44% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: yes
Technical impact: total

Timeline

ID reserved2023-03-23
Published2025-10-17 14:07
Reached IP-DB2026-10-24 23:53
Last updated2026-06-17 08:48

Assigned by (CNA): hikvision
NVD status: Deferred

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time