CVE-2024-58274

High

Published: 22 October 2025

Published

22 October 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

EPSS Score 0.0026 49.6th percentile

Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-58274 is a high-severity OS Command Injection (CWE-78) vulnerability in Aliyun (inferred from references). Its CVSS base score is 8.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 49.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2024-58274 is a command injection vulnerability (CWE-78) affecting Hikvision's Comprehensive Security Management Platform (CSMP) iSecure Center through version 2024-08-01. The issue enables execution of arbitrary commands embedded within $( ) syntax in JSON data submitted to the /center/api/installation/detection endpoint. It carries a CVSS v3.1 base score of 8.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility, low attack complexity, and lack of prerequisites.

Unauthenticated remote attackers can exploit this vulnerability by sending crafted JSON payloads to the vulnerable endpoint, achieving remote code execution (RCE) on the target system. The attack requires no privileges or user interaction and leverages a scope change for impact across low confidentiality, integrity, and availability.

Advisories and related resources, including those at https://forum.butian.net/article/498, https://xz.aliyun.com/news/14639, and a Nuclei detection template at https://github.com/ahisec/nuclei-tps/blob/main/http/vulnerabilities/hikvision/hikvision-csmp-installation-rce.yaml, document the issue and exploitation methods. The vulnerability has been actively exploited in the wild during 2024 and 2025.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2024-55040

Vulnerability details

Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2024-08-01 allows execution of a command within $( ) in /center/api/installation/detection JSON data, as exploited in the wild in 2024 and 2025.

CWE(s): CWE-78

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059 Command and Scripting Interpreter Execution

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

attack.mitre.org →

Why these techniques?

Unauthenticated command injection in public-facing web API endpoint enables remote exploitation of public-facing application (T1190) and arbitrary command execution via scripting interpreter (T1059).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0