VulnerabilityDeferred

CVE-2023-28814

Some versions of Hikvision's iSecure Center Product have an improper file upload control vulnerability.

CRITICAL 9.8EPSS 0.47%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.47%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Some versions of Hikvision's iSecure Center Product have an improper file upload control vulnerability. Due to the improper verification of file to be uploaded, attackers may upload malicious files to the server. iSecure Center is software released for China's domestic market only, with no overseas release.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.47% probability · 39th percentile
CISA KEV: Not listed
Weakness: CWE-434
Source: hsrc@hikvision.com

References

https://www.hikvision.com/cn/support/CybersecurityCenter/SecurityNotices/2023-03/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.