nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2025-66173 CVE-2025-66173
MEDIUM
Record summary
CVE-2025-66173 has a selected CVSS score of 6.2 (medium).
Description
There is a privilege escalation vulnerability in some Hikvision DVR products. Due to the improper implementation of authentication for the serial port, an attacker with physical access could exploit this vulnerability by connecting to the affected products and gaining access to an unrestricted shell environment.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 19, 2025 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
DS-7104HGHI-F1Browse Hikvision / DS-7104HGHI-F1 | CVE List | Versions below V4.30.122_201107 (including V4.30.122_201107) | affected |
DS-7204HGHI-F1Browse Hikvision / DS-7204HGHI-F1 | CVE List | Versions below V4.30.122_201107 (including V4.30.122_201107) | affected |
References
2hikvision.com
https://www.hikvision.com/en/support/cybersecurity/security-advisory/serial-port-privilege-escalation-vulnerabilities-in-some-hikvision-nvr-devices