CVE-2025-66174
BaseFortify
Publication date: 2025-12-19
Last updated on: 2025-12-23
Assigner: Hangzhou Hikvision Digital Technology Co., Ltd.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| hikvision | ds-7104hghi-f1_firmware | to 4.30.122_201107 (inc) |
| hikvision | ds-7104hghi-f1 | * |
| hikvision | ds-7204hghi-f1_firmware | to 4.30.122_201107 (inc) |
| hikvision | ds-7204hghi-f1 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an improper authentication issue in some Hikvision DVR products. It occurs because the authentication for the serial port is not properly implemented. An attacker with physical access to the device can exploit this by connecting to the serial port and running a series of commands without proper authentication.
How can this vulnerability impact me? :
The vulnerability allows an attacker with physical access to the affected DVR devices to execute commands via the serial port without proper authentication. This could lead to unauthorized control or manipulation of the device, potentially compromising the device's confidentiality and availability.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, restrict physical access to the affected Hikvision DVR devices to prevent attackers from connecting to the serial port. Additionally, monitor and control access to the devices' serial ports and consider applying any available firmware updates or patches from the vendor once released.