CVE-2025-66174

Friday, December 19, 2025

6.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Summary

There is an improper authentication vulnerability in some Hikvision DVR products. Due to the improper implementation of authentication for the serial port, an attacker with physical access could exploit this vulnerability by connecting to the affected products and run a series of commands.

Affected Software

Vendor	Product	Version Range	Status
Hikvision	DS-7104HGHI-F1	`Versions below V4.30.122_201107 (including V4.30.122_201107)`	affected
Hikvision	DS-7204HGHI-F1	`Versions below V4.30.122_201107 (including V4.30.122_201107)`	affected

Weaknesses

ADP Enrichment

CISA ADP Vulnrichment

SSVC:
Exploitation: none
- Automatable: yes
- Technical Impact: partial

References

https://www.hikvision.com/en/support/cybersecurity/security-advisory/serial-port-privilege-escalation-vulnerabilities-in-some-hikvision-nvr-devices/

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.