Introduction
Attackers can remotely run arbitrary commands on enterprise surveillance management systems without authentication, which affects the integrity and availability of physical security infrastructure. Hikvision's iSecure Center, a widely deployed centralized security management platform, has a critical command injection flaw that has been exploited in the wild in both 2024 and 2025.
About Hikvision and iSecure Center: Hikvision builds video surveillance and physical security technology, with a product portfolio that spans IP cameras, NVRs, and integrated management platforms. The iSecure Center platform targets large-scale enterprise deployments, giving unified control and monitoring of security devices across different environments. Because it runs in critical sectors, a vulnerability here can reach a lot of systems.
Technical Information
CVE-2024-58274 is a command injection vulnerability in the Hikvision Comprehensive Security Management Platform (CSMP) iSecure Center, affecting all versions up to and including 2024-08-01. The vulnerability sits in the /center/api/installation/detection endpoint, which processes JSON data as part of installation detection operations.
The root cause is improper validation and sanitization of user-supplied JSON data. The platform fails to neutralize shell metacharacters, which lets attackers inject commands using the shell command substitution syntax $( ). When the application receives such a payload, it puts the attacker-controlled value into a system-level command, which the underlying operating system then executes with the privileges of the application service account.
This flaw is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command). It requires no authentication, which widens the attack surface. Exploitation can lead to full system compromise, including arbitrary file writes, web shell deployment, and lateral movement within the network.
Proof of Concept
The Proof-of-Concept (PoC) for the vulnerability in Hikvision's Comprehensive Security Management Platform (CSMP) iSecure Center, as detailed in the Nuclei template, targets the /center/api/installation/detection endpoint. This endpoint is open to command injection because of improper handling of JSON data, specifically within the $( ) syntax.
An attacker can exploit this by sending a crafted JSON payload to the vulnerable endpoint. In that payload, commands enclosed in $( ) are executed by the system. For example, an attacker might send a JSON object where a parameter's value includes $(id), which prompts the system to run the id command and return user identity information.
The Nuclei template detects the vulnerability by sending such a payload and watching the system's response. If the system runs the command and returns its output, that confirms the vulnerability.
This PoC is for educational and testing purposes within controlled environments. Unauthorized exploitation of this vulnerability is illegal and unethical.
PoC Source:
Affected Systems and Versions
- Product: Hikvision CSMP iSecure Center
- Affected versions: All versions through 2024-08-01
- Vulnerable endpoint:
/center/api/installation/detection - No authentication required for exploitation
Vendor Security History
Hikvision has faced multiple critical vulnerabilities in its product lines, including:
- CVE-2021-36260: Command injection in IP cameras and NVRs, allowing unauthenticated remote code execution
- CVE-2023-28815: Command injection in iSecure Center
Command injection flaws keep recurring in both device firmware and management platforms, which points to ongoing problems with secure input handling and code review. Hikvision issues advisories and patches, but the frequency of similar vulnerabilities suggests the secure development lifecycle needs work.
