Lucene search

[email protected]CVE-2024-25064

HistoryMar 02, 2024 - 3:15 a.m.

CVE-2024-25064

2024-03-0203:15:06

[email protected]

web.nvd.nist.gov

cve-2024-25064

insufficient validation

unauthorized access

parameter manipulation

nvd

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.2%

JSON

Due to insufficient server-side validation, an attacker with login privileges could access certain resources that the attacker should not have access to by changing parameter values.

Affected configurations

NVD

Node

hikvisionhikcentral_professionalRange2.0.0–2.5.1

CPENameOperatorVersion
hikvision:hikcentral_professionalhikvision hikcentral professionallt2.5.1

CPE	Name	Operator	Version
hikvision:hikcentral_professional	hikvision hikcentral professional	lt	2.5.1

CNA Affected

[
  {
    "vendor": "Hikvision",
    "product": "HikCentral Professional",
    "versions": [
      {
        "version": "Versions after V2.0.0 and before V2.5.1",
        "status": "affected"
      }
    ]
  }
]

References

www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-hikcentral-professional/

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.2%

JSON

Related for CVE-2024-25064

cvelist1 nvd1 prion1