CVE-2025-66174

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-12-19

Last updated on: 2025-12-23

Assigner: Hangzhou Hikvision Digital Technology Co., Ltd.

Description

There is an improper authentication vulnerability in some Hikvision DVR products. Due to the improper implementation of authentication for the serial port, an attacker with physical access could exploit this vulnerability by connecting to the affected products and run a series of commands.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-19

Last Modified

2025-12-23

Generated

2026-07-06

AI Q&A

2025-12-20

EPSS Evaluated

2026-07-05

NVD

CVE-2025-66174

EUVD

EUVD-2025-204451

Affected Vendors & Products

Vendor	Product	Version / Range
hikvision	ds-7104hghi-f1_firmware	to 4.30.122_201107 (inc)
hikvision	ds-7104hghi-f1	*
hikvision	ds-7204hghi-f1_firmware	to 4.30.122_201107 (inc)
hikvision	ds-7204hghi-f1	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Mitigation Strategies

To mitigate this vulnerability, restrict physical access to the affected Hikvision DVR devices to prevent attackers from connecting to the serial port. Additionally, monitor and control access to the devices' serial ports and consider applying any available firmware updates or patches from the vendor once released.

Executive Summary

This vulnerability is an improper authentication issue in some Hikvision DVR products. It occurs because the authentication for the serial port is not properly implemented. An attacker with physical access to the device can exploit this by connecting to the serial port and running a series of commands without proper authentication.

Impact Analysis

The vulnerability allows an attacker with physical access to the affected DVR devices to execute commands via the serial port without proper authentication. This could lead to unauthorized control or manipulation of the device, potentially compromising the device's confidentiality and availability.

Hi! I’m here to help you understand CVE-2025-66174. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70