CVE-2024-58274

High

Published: 22 October 2025

Published

22 October 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

EPSS Score 0.0024 47.4th percentile

Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-58274 is a high-severity OS Command Injection (CWE-78) vulnerability in Aliyun (inferred from references). Its CVSS base score is 8.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 47.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Requires validation of JSON inputs to the /center/api/installation/detection endpoint, directly preventing command injection (CWE-78) exploitation.

SI-2 Flaw Remediation good match

prevent

Ensures timely identification, prioritization, and patching of the specific command injection flaw in Hikvision CSMP iSecure Center.

SC-7 Boundary Protection partial match

preventdetect

Monitors and controls network traffic to the vulnerable endpoint, blocking or detecting crafted JSON payloads from unauthenticated remote attackers.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059 Command and Scripting Interpreter Execution

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

attack.mitre.org →

Why these techniques?

Unauthenticated command injection in public-facing web API endpoint enables remote exploitation of public-facing application (T1190) and arbitrary command execution via scripting interpreter (T1059).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2024-08-01 allows execution of a command within $( ) in /center/api/installation/detection JSON data, as exploited in the wild in 2024 and 2025.

Deeper analysisAI

CVE-2024-58274 is a command injection vulnerability (CWE-78) affecting Hikvision's Comprehensive Security Management Platform (CSMP) iSecure Center through version 2024-08-01. The issue enables execution of arbitrary commands embedded within $( ) syntax in JSON data submitted to the /center/api/installation/detection endpoint. It carries a CVSS v3.1 base score of 8.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L), indicating high severity due to its network accessibility, low attack complexity, and lack of prerequisites.

Unauthenticated remote attackers can exploit this vulnerability by sending crafted JSON payloads to the vulnerable endpoint, achieving remote code execution (RCE) on the target system. The attack requires no privileges or user interaction and leverages a scope change for impact across low confidentiality, integrity, and availability.

Advisories and related resources, including those at https://forum.butian.net/article/498, https://xz.aliyun.com/news/14639, and a Nuclei detection template at https://github.com/ahisec/nuclei-tps/blob/main/http/vulnerabilities/hikvision/hikvision-csmp-installation-rce.yaml, document the issue and exploitation methods. The vulnerability has been actively exploited in the wild during 2024 and 2025.