CVE-2023-28815: Hikvision iSecure Center Command Injection
A critical command injection flaw (CVSS 3.1 base score 9.8) in some versions of Hikvision iSecure Center could let attackers gain platform privileges and run arbitrary commands. The product was released only for China's domestic market. No confirmed exploitation appears in the sources consulted, and the record lacks affected and fixed version details.
Overview
Hikvision's security notice referenced for CVE-2023-28815 describes a command injection flaw in some versions of the iSecure Center product. The record attributes it to insufficient parameter validation.
Impact
- According to the record, an attacker may gain platform privileges and execute arbitrary commands on the affected system.
- The CNA hsrc@hikvision.com provides a CVSS 3.1 base score of 9.8 (critical).
Affected products and versions
- The record does not list affected versions or builds, so the exact scope is unknown.
- The description states that iSecure Center was released only for China's domestic market, with no overseas release.
Exploitation status
- The record shows this CVE is not listed in CISA KEV. No confirmed exploitation appears in the sources consulted.
- The EPSS probability of 0.01423 (percentile 0.72212) is a statistical estimate and not evidence of exploitation.
Remediation and mitigation
- The record contains no fixed version. Review the Hikvision security notice for vendor guidance.
- Inventory any iSecure Center deployments and confirm whether they match the vendor notice.
- Restrict network access to management interfaces and limit the privileges of service accounts where possible.
Detection guidance
- Review platform logs for unexpected process execution or administrative actions originating from the application service.
- Monitor for unusual outbound connections from the server hosting the platform.
Limitations of the available information
- Affected versions, fixed versions, the CWE name and vendor patch details are absent from the record.
- The vendor notice content was not available for review in this analysis.
Frequently asked questions
Is CVE-2023-28815 being actively exploited?
The record shows this CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
Which versions are affected and which are fixed?
The record does not list affected or fixed versions. Consult the Hikvision security notice linked in the references for vendor guidance.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.