A critical directory traversal vulnerability in Hikvision CSMP iSecure Center allows unauthenticated attackers to upload arbitrary files, posing a severe risk of system compromise.

This vulnerability is a path traversal flaw (CWE-24) within the /center/api/files endpoint, allowing unauthenticated remote attackers to bypass directory restrictions and upload arbitrary files.

The ability for an unauthenticated attacker to upload files to the server can lead to remote code execution, unauthorized data access, and complete system compromise. Given the CVSS score of 8.3, this vulnerability represents a high risk to business continuity and data integrity, especially since the product is designed for security management.

Immediate Action: Contact Hikvision support or monitor the official vendor portal for available security patches, as a specific fixed version is currently not public.

Proactive Monitoring: Review web server access logs for suspicious requests directed at /center/api/files and monitor for unauthorized file creation or changes in system directories.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests containing directory traversal sequences, such as "../", directed at the vulnerable API endpoint.

Public Exploit Available: Unknown.

Due to the severity of this unauthenticated file upload vulnerability, organizations using Hikvision CSMP iSecure Center must prioritize the implementation of network-level filtering to restrict access to the /center/api/files endpoint. Administrators should maintain close contact with the vendor for the release of a definitive patch and apply it immediately upon availability.