Global - EN
Serial Port Privilege Escalation Vulnerabilities in Some Hikvision DVR Devices
SN No. HSRC-202512-01
Edit: Hikvision Security Response Center (HSRC)
Initial Release Date: 2025-12-19
Summary
(1) CVE-2025-66173 – There is a privilege escalation vulnerability in some Hikvision DVR products. Due to the improper implementation of authentication for the serial port, an attacker with physical access could exploit this vulnerability by connecting to the affected products and gaining access to an unrestricted shell environment.
(2) CVE-2025-66174 – There is an improper authentication vulnerability in some Hikvision DVR products. Due to the improper implementation of authentication for the serial port, an attacker with physical access could exploit this vulnerability by connecting to the affected products and run a series of commands.
Scoring
CVSS v3.1 is adopted in scoring these vulnerabilities
(http://www.first.org/cvss/specification-document)
CVE-2025-66173
Base score: 6.2 (CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
CVE-2025-66174
Base score: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L)
Affected Versions and Fix
Product Name |
CVE ID |
Affected Versions |
Fixed Version |
DS-7104HGHI-F1
|
CVE-2025-66173、CVE-2025-66174 |
Versions below V4.30.122_201107 (including V4.30.122_201107) |
|
DS-7204HGHI-F1 |
CVE-2025-66173、CVE-2025-66174 |
Versions below V4.30.122_201107 (including V4.30.122_201107) |
Source of vulnerability information
These vulnerabilities were reported to HSRC by Aaron J Jose in India, and we also want to acknowledge the cooperation of the National Computer Emergency Response Team of India (CERT-In) who coordinated with us to handle this vulnerability.
Contact Us
To report any security issues or vulnerabilities in Hikvision products and solutions, please contact Hikvision Security Response Center at hsrc@hikvision.com.
Hikvision would like to thank all security researchers for your attention to our products.
Declaration
This document is provided on an “AS IS” basis and without warranties of any kind, either express or implied, including but not limited to the warranties of merchantability or fitness for a particular purpose.
Hikvision or any of its directly or indirectly controlled subsidiaries or its suppliers shall not be liable for any damages arising out of or in connection with the use of this document, including direct, indirect, incidental, special, or consequential damages.
Hikvision reserves the right to revise or update this document at any time.
Hikvision.com uses strictly necessary cookies and related technologies to enable the website to function. With your consent, we would also like to use cookies to observe and analyse traffic levels and other metrics / show you targeted advertising / show you advertising on the basis of your location / tailor our website's content. For more information on cookie practices please refer to our cookie policy.
