A critical OS command injection vulnerability in Hikvision CSMP iSecure Center allows unauthenticated attackers to execute arbitrary system commands, with confirmed exploitation observed in the wild.

The application fails to properly neutralize special elements within JSON data sent to the /center/api/installation/detection endpoint, specifically failing to sanitize input containing shell command substitution sequences. This vulnerability is exploitable by an unauthenticated remote attacker.

Successful exploitation of this flaw grants an attacker the ability to execute arbitrary commands on the underlying host operating system with the privileges of the application service. Given the CVSS score of 8.3, this represents a high risk of full system compromise, potential data exfiltration, and the ability for attackers to pivot into the internal network, leading to significant operational disruption and loss of confidentiality.

Immediate Action: Contact Hikvision support or monitor the official vendor security portal to obtain and apply the necessary firmware or software update.

Proactive Monitoring: Review web access logs for requests directed to the /center/api/installation/detection endpoint containing suspicious characters or command substitution syntax, such as $( ).

Compensating Controls: Implement strict network segmentation and utilize a Web Application Firewall (WAF) to block requests containing shell injection payloads directed at the vulnerable API endpoint.

Public Exploit Available: Yes, a nuclei detection template exists and public technical write-ups detailing the exploit mechanism are available via the referenced security research articles.

The presence of confirmed active exploitation elevates this vulnerability to the highest priority for remediation. Organizations running the affected Hikvision CSMP iSecure Center software must isolate the instance from the public internet immediately if a patch cannot be applied, and audit system logs for signs of unauthorized activity.