Introduction
Active exploitation of Hikvision iSecure Center in 2024 and 2025 has led to unauthorized file uploads, and potentially to remote code execution, across critical deployments. Attackers use a directory traversal flaw to get past upload restrictions. That directly affects organizations that rely on the platform to manage physical security.
About Hikvision iSecure Center: Hikvision is one of the world's largest manufacturers of video surveillance and security management systems, with millions of devices deployed. iSecure Center is its security management platform, used mainly in China's domestic market. It combines video surveillance, access control, and alarm management for government and enterprise environments.
Technical information
CVE-2023-53691 is a directory traversal file upload vulnerability in Hikvision CSMP iSecure Center through 2023-06-25. The flaw is in the /center/api/files endpoint, which handles file uploads. The endpoint does not sufficiently validate user-supplied file paths, so an attacker can craft an upload request that contains directory traversal sequences such as ../. The server then writes the file outside the intended upload directory, possibly to a location that is web accessible or executable by the server.
The vulnerability is classified as CWE-24 (Path Traversal). This weakness occurs when an application builds file paths from user input without proper sanitization, which lets attackers escape restricted directories. By exploiting it, an attacker can upload arbitrary files, such as web shells, to sensitive locations and gain remote code execution with the privileges of the web server process.
As of this writing, no official advisory or research publication has released public code snippets or a proof of concept.
Affected systems and versions
- Hikvision CSMP iSecure Center through 2023-06-25
- All deployments running versions released on or before 2023-06-25 are affected
- The vulnerability affects the
/center/api/filesendpoint specifically
Vendor security history
Hikvision has a documented history of critical vulnerabilities in its security management platforms and surveillance devices. Notable related issues include:
- CVE-2023-28814: Improper file upload control in iSecure Center
- CVE-2023-28815: Command injection in iSecure Center
- CVE-2017-7921: Authentication bypass in Hikvision cameras and DVRs, still exploited years after disclosure
Patch response has varied. Some vulnerabilities have remained unpatched for extended periods, and others were only partially addressed. Hikvision releases iSecure Center mainly for China's domestic market, which can complicate international support and patch availability.
