CVE-2024-47485

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

There is a CSV injection vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could build malicious data to generate executable commands in the CSV file.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1236

Affected software

VendorProductVersions
HikvisionHikCentral Master LiteVersions between V2.0.0 and V2.2.1
hikvisionhikcentral_master_lite>= 2.0.0, < 2.2.1

References

Timeline

Published
Oct 18, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-474866.1There is an XSS vulnerability in some HikCentral Master Lite versions. If exploited, an attacker could inject scripts into certain pages by CVE-2024-474878.8There is a SQL injection vulnerability in some HikCentral Professional versions. This could allow an authenticated user to execute arbitraryCVE-2024-474895.8An Improper Handling of Exceptional Conditions vulnerability in the Packet Forwarding Engine (pfe) of the Juniper Networks Junos OS Evolved CVE-2024-47498.3The wp-eMember WordPress plugin before 10.3.9 does not sanitize and escape the "fieldId" parameter before outputting it back in the page, leCVE-2024-474908.2An Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the Packet Forwarding Engine (PFE) of Juniper NetworCVE-2024-474915.9An Improper Handling of Exceptional Conditions vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS CVE-2024-474936.5A Missing Release of Memory after Effective Lifetime vulnerability in the Packet Forwarding Engine (PFE) of the Juniper Networks Junos OS onCVE-2024-474945.9A Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in the AgentD process of Juniper Networks Junos OS allows an attacker who CVE-2024-474956.7An Authorization Bypass Through User-Controlled Key vulnerability allows a locally authenticated attacker with shell access to gain full conCVE-2024-474965.5A NULL Pointer Dereference vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS allows a local, low-privileged aCVE-2024-474977.5An Uncontrolled Resource Consumption vulnerability in the http daemon (httpd) of Juniper Networks Junos OS on SRX Series, QFX Series, MX SerCVE-2024-474986.5An Unimplemented or Unsupported Feature in UI vulnerability in the CLI of Juniper Networks Junos OS Evolved on QFX5000 Series allows an unau
CVE-2024-47485: Critical severity, CVSS 9.8 | Vulnix