CVE-2025-39247
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-39247 is a high-severity Improper Access Control (CWE-284) vulnerability. Its CVSS base score is 8.6 (High).
Operationally, ranked at the 39th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-39247 is an access control vulnerability (CWE-284) present in some versions of HikCentral Professional. Published on 2025-08-29, it enables an unauthenticated user to obtain admin permissions. The issue carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N), reflecting high severity due to network accessibility, low attack complexity, no privileges or user interaction required, and a scope change with high confidentiality impact.
An unauthenticated attacker can exploit this vulnerability remotely over the network. With no prerequisites for privileges or user interaction, exploitation grants admin-level access, potentially exposing sensitive configuration data or control over the affected HikCentral Professional instance.
Mitigation guidance is available in the Hikvision security advisory at https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-some-hikcentral-products/.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-26202
Vulnerability Data
There is an Access Control Vulnerability in some HikCentral Professional versions. This could allow an unauthenticated user to obtain the admin permission.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces approved authorizations for logical access, stopping unauthorized actors from reaching resources.
Enforces flow-control policies that restrict information movement between subjects and objects.
Documents duties and assigns access so that no single account can bypass intended restrictions.
Limits each account to the minimum privileges needed, reducing the chance of unauthorized access.
Defines account types, assigns/removes access, and reviews accounts to ensure only authorized actors can reach resources.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.15 directly mandates determining requirements, defining/implementing topic-specific access control policy+rules (with explicit references to 8.3, 5.16, 5.18), and enforcing authorized access while preventing unauthorized access, which squarely stops exploitation of most CWE-284 instances; the bounded remainder is the physical slice (explicitly delegated to 7.2-7.4) plus any second-order defects like path traversal that are not authorization decisions.
A.5.16's identity lifecycle (unique binding, timely disable/remove, no duplicates, oversight of shared/non-human) directly stops most improper access by ensuring the actor in an access decision is correctly identified and authorized; the bounded remainder is non-identity mechanisms in CWE-284 such as path traversal or CSRF that do not turn on actor identity at all.
A.5.18 directly governs the provisioning, review, adjustment and timely revocation of both physical and logical access rights per business rules, segregation of duties and risk-evaluated changes/terminations; this stops most unauthorized-actor exploitation paths named by CWE-284, with a bounded remainder (e.g. path-traversal or CSRF cases that are not authorization decisions at all)
A.6.7's policy, rules, mechanisms, authentication requirements, remote access controls, network restrictions, and device measures (e.g. screen locks, firewalls, malware protection) directly stop unauthorized actors from exploiting improper access control in remote settings; remainder is non-remote or physical-only slices of CWE-284 (as in AC-3's own mostly precedent).
A.8.1 mandates access controls, storage encryption, software restrictions, malware protection, remote lock/wipe, physical/logical device protections, and policy-driven enforcement that stop unauthorized actors from exploiting improper access control on endpoints; remainder is non-endpoint or non-device slices of CWE-284 (e.g. server-side authorization logic).
A.8.2 directly controls allocation, review, expiry, temporary use, separate identities and heightened authentication for privileged rights per the access policy, which stops most improper-access-control exploitation paths for privileged resources; the bounded remainder is non-privileged improper access control (e.g. ordinary user rights, path traversal, CSRF).
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.