CVE-2025-39247

HIGH
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-39247 has a selected CVSS score of 8.6 (high); EIP currently links 1 repository PoC.

Description

There is an Access Control Vulnerability in some HikCentral Professional versions. This could allow an unauthenticated user to obtain the admin permission.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 29, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

HikCentral Professional

Browse Hikvision / HikCentral Professional
CVE ListVersions between V2.3.1 and V2.6.2affected
Version V3.0.0affected

Proofs of concept

1

Repository PoCs

GitHubSita-Technologies/CVE-2025-39247Repository PoCby Sita-Technologies0Scanner2 files

41.6 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a Python script that recovers a per-install license ActiveCode from a pre-authentication endpoint on HikCentral Professional servers. It decrypts the response using hardcoded AES keys extracted via reverse engineering. The script does not perform the password reset or any destructive action; it prints manual instructions for an operator to complete the takeover through the legitimate web UI.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README.md analysis and a Python PoC script (poc/cve_2025_39247_poc.py) for CVE-2025-39247. The README documents a vulnerability chain: an unauthenticated information disclosure endpoint leaks a license ActiveCode, which can then be used manually through the legitimate web UI to reset the admin password. The PoC script implements only the read-only information disclosure half of the chain; it makes two unauthenticated POST requests to retrieve and decrypt a QR code containing the ActiveCode, then prints manual instructions for the operator to complete the password reset via the browser. The script contains no code that writes to the target, establishes persistence, exfiltrates data to a third party, or performs any action beyond the described vulnerability demonstration. No concealed executable behavior, deceptive payload, or operator-directed harm is present.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareHikCentral Professional
Attack typesinformation disclosurecredential recovery
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script only performs read-only information disclosure (recovering an ActiveCode) and prints manual takeover steps. It contains no code to send a password reset request or modify the target. The script's own description states it 'does NOT perform the password reset' and is a 'recon-only' tool.

poc/cve_2025_39247_poc.py:86-88README.md:425-426README.md:472

Requirements

  • Target must have at least one license activated; trial/unlicensed instances have no ActiveCode to leak.poc/cve_2025_39247_poc.py:67-72
  • Target must be running a vulnerable version (V2.3.1 - V2.6.2, V3.0.0).poc/cve_2025_39247_poc.py:16

Observed behavior

  • Sends an unauthenticated POST to /ISAPI/Bumblebee/Platform/V0/Security/Crypto to obtain an anonymous session token (SID).poc/cve_2025_39247_poc.py:138-150
  • Sends an unauthenticated POST to /ISAPI/Bumblebee/Platform/V1/License/ActiveCode/QRCode to fetch a base64-encoded PNG QR code.poc/cve_2025_39247_poc.py:153-162
  • Decodes the QR code to extract a URL containing an AES-encrypted payload, then decrypts it using hardcoded key and IV to recover the license ActiveCode.poc/cve_2025_39247_poc.py:194-214poc/cve_2025_39247_poc.py:98-99
  • Prints manual instructions for an operator to use the recovered ActiveCode in the legitimate 'Forgot password' web UI to reset the admin password.poc/cve_2025_39247_poc.py:246-262
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Hardcoded Cryptographic Key
WwXxYyZz1234!@#$AES-128 key used to decrypt the QR code payload; hardcoded in the PoC script (line 98) and documented as recovered from the target binary. This is part of the exploit logic, not a backdoor.poc/cve_2025_39247_poc.py:98
Hardcoded Cryptographic Iv
AaBbCcDd1234!@#$AES-128 IV used to decrypt the QR code payload; hardcoded in the PoC script (line 99) and documented as recovered from the target binary. Part of the exploit logic.poc/cve_2025_39247_poc.py:99
Target Endpoint
/ISAPI/Bumblebee/Platform/V0/Security/CryptoUnauthenticated endpoint used by the PoC to obtain a session ID and RSA public key (step 1 of the recon chain).poc/cve_2025_39247_poc.py:138-139
Target Endpoint
/ISAPI/Bumblebee/Platform/V1/License/ActiveCode/QRCodeUnauthenticated endpoint used by the PoC to fetch the QR code containing the encrypted ActiveCode (step 2 of the recon chain).poc/cve_2025_39247_poc.py:154-155
Manual Takeover Instructions
Prints steps for the operator to reset the admin password via the legitimate web UI using the recovered ActiveCode.The PoC explicitly does not automate the password reset; it prints a recipe for manual completion (lines 246-262). This limits the script to a read-only reconnaissance tool.poc/cve_2025_39247_poc.py:246-262
Review boundaries

What the analysis did not establish

  • Evidence is limited to the README and Python script; the actual binary (platform.dll) and Nginx config are not included, so the reverse engineering claims cannot be independently verified from the supplied files.
  • The script's behavior is inferred from static analysis of the source code; it was not executed against a live target.
  • Only the two text files (README.md and poc/cve_2025_39247_poc.py) from the repository were supplied; no other files, binaries, or build artifacts were reviewed.
  • The PoC script imports external libraries (requests, cryptography, pillow, pyzbar) which are not reviewed; the review assumes these well-known libraries behave as documented.
  • The evidence describes a vulnerability in a third-party product (HikCentral Professional) but does not include that product's binaries; the analysis of the vulnerability itself is taken as given.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

2