Hikvision HikCentral CSV Injection, XSS, and SQL Injection Vulnerabilities (CVE-2024-47485/47486/47487)

From this webpage screenshot, the following key vulnerability information can be obtained: 1. Vulnerability ID: - HSRC-202410-01 2. Editor: - Hikvision Security Response Center (HSRC) 3. Initial Release Date: - 2024-10-18 4. Vulnerability Description: - CSV Injection Vulnerability: Certain versions of HikCentral Master Lite contain a CSV injection vulnerability. If exploited, attackers can construct malicious data to generate executable commands. - XSS Vulnerability: Certain versions of HikCentral Master Lite contain an XSS vulnerability. If exploited, attackers can inject scripts into certain pages by constructing malicious data. - SQL Injection Vulnerability: Certain versions of HikCentral Professional contain an SQL injection vulnerability, allowing authenticated users to execute arbitrary SQL queries. 5. CVE IDs: - CVE-2024-47485 - CVE-2024-47486 - CVE-2024-47487 6. CVSS Scores: - CVE-2024-47485: 5.5 - CVE-2024-47486: 2.1 - CVE-2024-47487: 7.2 7. Affected Versions and Fixes: - HikCentral Master Lite: Affected versions and corresponding fixed versions. - HikCentral Professional: Affected versions and corresponding fixed versions. 8. Contact Information: - Hikvision Security Response Center: hsrc@hikvision.com 9. Acknowledgments: - Thank you to all security researchers for their attention to Hikvision products. This information provides a detailed description of vulnerabilities discovered in the HikCentral product series, along with recommended remediation measures.

Goal Reached Thanks to every supporter — we hit 100%!

Hikvision HikCentral CSV Injection, XSS, and SQL Injection Vulnerabilities (CVE-2024-47485/47486/47487)