CVE-2025-39245 Overview
CVE-2025-39245 is a CSV Injection vulnerability affecting certain versions of Hikvision HikCentral Master Lite. The flaw allows an attacker to inject executable commands into CSV data processed by the application. When a user opens the exported CSV file in a spreadsheet application such as Microsoft Excel, the embedded formula can execute on the victim's system. The vulnerability is categorized under CWE-1236, Improper Neutralization of Formula Elements in a CSV File. Successful exploitation requires user interaction and depends on the spreadsheet application's formula handling behavior.
Critical Impact
An attacker can inject spreadsheet formulas into HikCentral Master Lite CSV exports, potentially triggering command execution or data exfiltration when a downstream user opens the file.
Affected Products
- Hikvision HikCentral Master Lite (specific vulnerable versions listed in the Hikvision Security Advisory)
Discovery Timeline
- 2025-08-29 - CVE-2025-39245 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-39245
Vulnerability Analysis
The vulnerability stems from HikCentral Master Lite writing user-controllable input into exported CSV files without neutralizing formula-trigger characters. Spreadsheet applications interpret cells beginning with =, +, -, @, or tab and carriage return characters as formulas. When an attacker embeds a payload such as =cmd|'/c calc'!A1 into a field that is later exported, the receiving user's spreadsheet client may execute the formula on open. This class of issue is tracked as CWE-1236.
Exploitation requires the attacker to place malicious content into a data field that HikCentral Master Lite subsequently exports. A second user must then open the exported CSV in a formula-evaluating application and, in most modern spreadsheet clients, approve a security prompt. The scope changes across trust boundaries because the injection occurs in one context and executes in another.
Root Cause
HikCentral Master Lite does not sanitize or prefix formula-trigger characters when generating CSV exports. Proper mitigation typically requires prefixing risky cell values with a single quote or wrapping them in a way that forces literal string interpretation.
Attack Vector
An unauthenticated attacker submits crafted input through a network-facing HikCentral function that stores data later exported as CSV. When an operator or administrator exports and opens the file, the payload executes in the spreadsheet client. The vulnerability requires user interaction and produces a limited availability impact according to the CVSS vector.
No verified public exploit code is available. Refer to the Hikvision Security Advisory for vendor guidance.
Detection Methods for CVE-2025-39245
Indicators of Compromise
- CSV exports from HikCentral Master Lite containing cells that begin with =, +, -, or @ in fields that should hold user-supplied text.
- Spreadsheet processes such as excel.exe spawning child processes like cmd.exe, powershell.exe, or mshta.exe shortly after opening a HikCentral export.
- Outbound network connections initiated from a spreadsheet process following the open of an exported report.
Detection Strategies
- Inspect stored HikCentral Master Lite fields for values starting with formula-trigger characters, particularly device names, descriptions, and comment fields.
- Alert on parent-child process relationships where excel.exe, soffice.bin, or equivalent spreadsheet binaries spawn scripting interpreters or shells.
- Correlate CSV file open events on operator workstations with subsequent DNS or HTTP callbacks from the same process.
Monitoring Recommendations
- Enable endpoint process telemetry on workstations used by HikCentral operators and forward events to a centralized analytics platform.
- Log all HikCentral Master Lite export actions and retain samples of exported files for forensic review.
- Review Microsoft Office trust center logs and Protected View bypass events for exported HikCentral reports.
How to Mitigate CVE-2025-39245
Immediate Actions Required
- Apply the fixed HikCentral Master Lite version identified in the Hikvision Security Advisory.
- Restrict who can submit data into HikCentral fields that are later exported, and audit existing records for formula-trigger characters.
- Instruct operators to open exported CSV files only in applications configured to disable automatic formula evaluation.
Patch Information
Hikvision has published a security advisory covering vulnerabilities in HikCentral products. Consult the Hikvision Security Advisory for the specific fixed version and upgrade instructions for HikCentral Master Lite.
Workarounds
- Disable automatic formula evaluation in spreadsheet clients used to review HikCentral exports, or open exports in a plain text editor first.
- Sanitize CSV exports at an intermediate step by prefixing any cell starting with =, +, -, or @ with a single quote before distribution.
- Enforce Microsoft Office Protected View and block child process creation from Office applications through attack surface reduction rules.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
