CVE-2025-66177 is a high-severity stack overflow vulnerability affecting Hikvision NVR/DVR/CVR/IPC models within their device Search and Discovery feature. An unauthenticated attacker on the same local area network (LAN) can exploit this by sending specially crafted packets, potentially causing the device to malfunction with high impact to confidentiality, integrity, and availability. While the vulnerability has a high FAUCET Risk Score of 90/100 and a CVSS score of 8.8, there is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Hikvision | DS-2CD1xx1 | Versions below V5.7.23_241015 (including V5.7.23_241015)CNA affected | |
| Hikvision | DS-2CD1xxxG0(T) | Versions below V5.7.23_241015 (including V5.7.23_241015)CNA affected | |
| Hikvision | DS-2CD1xxxG2 | Versions below V5.7.13_230822 (including V5.7.13_230822)CNA affected | |
| Hikvision | DS-2CD29xxG0 | Versions below V5.7.21_240814 (including V5.7.21_240814)CNA affected | |
| Hikvision | DS-2CD2Dx5G1 | Versions below V5.7.210_240826 (including V5.7.210_240826)CNA affected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.