SecuriTricks - CVE-2025-39245

Description

There is a CSV Injection Vulnerability in some HikCentral Master Lite versions. This could allow an attacker to inject executable commands via malicious CSV data.

Product(s) Impacted

Vendor	Product	Versions
Hikvision	Hikcentral Master Lite	*

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-1236

Improper Neutralization of Formula Elements in a CSV File

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	hikvision	hikcentral_master_lite	/	/	/	/	/	/	/	/

References

https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-some-hikcentral-products/

CVSS Score

4.7 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: NONE
Scope: CHANGED
Confidentiality Impact: NONE
Integrity Impact: NONE
Availability Impact: LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L

View Vector String

Timeline

Published: Aug. 29, 2025, 3:15 a.m.
Last Modified: Aug. 29, 2025, 4:24 p.m.

Status : Awaiting Analysis

CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.

More info

Source

hsrc@hikvision.com

CVE-2025-39245