CVE-2025-66174

6.8 mediumEPSS 0.4%

Medium (6.8) in hikvision. EPSS 0.4% chance of exploitation in the next 30 days.

There is an improper authentication vulnerability in some Hikvision DVR products. Due to the improper implementation of authentication for the serial port, an attacker with physical access could exploit this vulnerability by connecting to the affected products and run a series of commands.

Severity

CVSS 3.1

6.8 medium

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 28% of CVEs (scores of 2026-10-31)
CWE: CWE-287
Published: 2025-12-19
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

hikvision:ds-7104hghi-f1_firmware
hikvision:ds-7204hghi-f1_firmware

References

https://www.hikvision.com/en/support/cybersecurity/security-advisory/serial-port-privilege-escalation-vulnerabilities-in-some-hikvision-nvr-devices/

Check your stack JSON