CVE-2025-66173

6.2 mediumEPSS 0.2%

Medium (6.2) in hikvision. EPSS 0.2% chance of exploitation in the next 30 days.

There is a privilege escalation vulnerability in some Hikvision DVR products. Due to the improper implementation of authentication for the serial port, an attacker with physical access could exploit this vulnerability by connecting to the affected products and gaining access to an unrestricted shell environment.

Severity

CVSS 3.1

6.2 medium

CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 11% of CVEs (scores of 2026-10-31)
CWE: CWE-269
Published: 2025-12-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

hikvision:ds-7104hghi-f1_firmware
hikvision:ds-7204hghi-f1_firmware

References

https://www.hikvision.com/en/support/cybersecurity/security-advisory/serial-port-privilege-escalation-vulnerabilities-in-some-hikvision-nvr-devices/

Check your stack JSON