CVE-2025-39246

There is an Unquoted Service Path Vulnerability in some HikCentral FocSign versions. This could allow an authenticated user to potentially enable escalation of privilege via local access.

Published:Aug 29, 2025

Last Modified:Apr 15, 2026

EPS:Aug 29, 2025

EPSS Score:0.0004

CVSS Score:5.3

Affected Products

No affected product recorded yet

Exploits

No exploit reference

Common Weakness Enumeration

CWE-428 Unquoted Search Path or Element

Common Attack Pattern Enumeration and Classification (CAPEC)

No CAPEC recorded yet

References

https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-vulnerabilities-in-some-hikcentral-products/

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High