CVE-2023-28815
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2023-28815 is a critical-severity Improper Neutralization of Parameter/Argument Delimiters (CWE-141) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Command and Scripting Interpreter (T1059); ranked in the top 29% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2023-28815 is a command injection vulnerability stemming from insufficient parameter validation in some versions of Hikvision's iSecure Center product. iSecure Center is software released exclusively for China's domestic market, with no overseas release. The issue is mapped to CWE-141 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Remote, unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation enables attackers to gain platform privileges and execute arbitrary commands on the affected system, potentially leading to full compromise.
Hikvision has issued a security notice on this vulnerability, available at https://www.hikvision.com/cn/support/CybersecurityCenter/SecurityNotices/2023-04/.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-32450
Vulnerability Data
Some versions of Hikvision's iSecure Center Product contain insufficient parameter validation, resulting in a command injection vulnerability. Attackers may exploit this to gain platform privileges and execute arbitrary commands on the system.iSecure Center is software released for China's domestic market…
more
only, with no overseas release.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Input validation directly requires checking and neutralizing delimiter characters in received data before forwarding to downstream components.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input neutralization to prevent delimiter injection.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect delimiter issues but does not itself implement the neutralization.
Secure development life cycle mandates input validation and sanitization that directly prevents delimiter injection.
Application security requirements explicitly call for neutralizing special characters in inputs passed to downstream components.
Secure system architecture principles encourage safe interfaces but do not prescribe delimiter neutralization.
Secure coding standards require proper escaping or neutralization of parameter delimiters in all downstream calls.