Introduction
An attacker with unauthorized access to surveillance management infrastructure can cut off monitoring, tamper with security footage, and compromise physical access controls. CVE-2025-39247 is a high-severity access control vulnerability in Hikvision's HikCentral Professional platform that could let an unauthenticated attacker obtain full administrative privileges on an affected system.
About Hikvision and HikCentral Professional: Hikvision is one of the largest manufacturers of video surveillance equipment in the world, with millions of devices deployed in commercial, government, and industrial environments. HikCentral Professional is its flagship platform for centrally managing video surveillance, access control, and alarm systems, and many security operations depend on it.
Technical information
CVE-2025-39247 is classified as an access control vulnerability in certain versions of HikCentral Professional. It allows an unauthenticated user to escalate privileges and obtain administrator permissions on the management platform. The flaw is exploitable over the network, requires no prior authentication, and needs no user interaction. Its CVSS v3.1 score of 8.6 reflects both the high impact and how easy it is to exploit.
The root cause is a failure in the platform's access control mechanisms. Public sources have published nothing beyond that: no further technical details, no vulnerable endpoints, and no code snippets. An attacker who exploits the flaw could gain full control over surveillance management, including camera feeds, access control, and alarm systems. No proof-of-concept or exploitation details are available as of this writing.
Affected systems and versions
Only some versions of HikCentral Professional are affected, and public advisories have not disclosed which ones. Organizations should consult the official Hikvision advisory for details as they become available.
Vendor security history
Hikvision has a history of critical vulnerabilities in its security management products:
- CVE-2025-34067: Remote code execution in HikCentral Professional (CVSS 10.0)
- CVE-2024-25063 and CVE-2024-25064: Access control issues in HikCentral Professional
- CVE-2023-28808: Access control flaw in Hybrid SAN and cluster storage
- CVE-2022-28173: Access control issue in wireless bridge products
Hikvision has set up a Security Response Center and has worked with external researchers. Even so, high-impact vulnerabilities keep recurring, which suggests the company still struggles with secure development practices.
