Vulnerability · Published Oct 22, 2025 · Assigned by mitre
CVE-2024-58274
High 8.3
In plain English
A high-severity OS command injection in CSMP iSecure Center from Hikvision. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 17.4% (higher than 97% of all known vulnerabilities).
Severity (CVSS 3.1)8.3High
Exploit odds (30 days)17.4%top 2.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2024-08-01 allows execution of a command within $( ) in /center/api/installation/detection JSON data, as exploited in the wild in 2024 and 2025.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Hikvision | CSMP iSecure Center | 0 – through 2024-08-01 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L