nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2025-66177 CVE-2025-66177
HIGH
Record summary
CVE-2025-66177 has a selected CVSS score of 8.8 (high); EIP currently links 1 repository PoC.
Description
There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision NVR/DVR/CVR/IPC models. If exploited, an attacker on the same local area network (LAN) could cause the device to malfunction by sending specially crafted packets to an unpatched device.
Description source: CVE List
Exploitation context
Available material
- Repository PoCs
- 1
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 13, 2026 · Source: CVE List
Affected products and versions
Showing 12 of 97| Product | Source | Version range | Status |
|---|---|---|---|
DS-2CD1xx1Browse Hikvision / DS-2CD1xx1 | CVE List | Versions below V5.7.23_241015 (including V5.7.23_241015) | affected |
DS-2CD1xxxG0(T)Browse Hikvision / DS-2CD1xxxG0(T) | CVE List | Versions below V5.7.23_241015 (including V5.7.23_241015) | affected |
DS-2CD1xxxG2Browse Hikvision / DS-2CD1xxxG2 | CVE List | Versions below V5.7.13_230822 (including V5.7.13_230822) | affected |
DS-2CD29xxG0Browse Hikvision / DS-2CD29xxG0 | CVE List | Versions below V5.7.21_240814 (including V5.7.21_240814) | affected |
DS-2CD2Dx5G1Browse Hikvision / DS-2CD2Dx5G1 | CVE List | Versions below V5.7.210_240826 (including V5.7.210_240826) | affected |
DS-2CD2xx1G0Browse Hikvision / DS-2CD2xx1G0 | CVE List | Versions below V5.7.23_241015 (including V5.7.23_241015) | affected |
DS-2CD3xx1G0Browse Hikvision / DS-2CD3xx1G0 | CVE List | Versions below V5.7.23_241015 (including V5.7.23_241015) | affected |
DS-2CD3xx1G2Browse Hikvision / DS-2CD3xx1G2 | CVE List | Versions below V5.7.13_230822 (including V5.7.13_230822) | affected |
DS-2CD64x5G1Browse Hikvision / DS-2CD64x5G1 | CVE List | Versions below V5.7.210_240826 (including V5.7.210_240826) | affected |
DS-2XC6xxxG0Browse Hikvision / DS-2XC6xxxG0 | CVE List | Versions below V5.7.7build241203 (including V5.7.7build241203) | affected |
DS-2XE6xxxG0Browse Hikvision / DS-2XE6xxxG0 | CVE List | Versions below V5.7.7build241203 (including V5.7.7build241203) | affected |
DS-710xNI-G1/(xP)/MBrowse Hikvision / DS-710xNI-G1/(xP)/M | CVE List | Build date before 250807 | affected |
Proofs of concept
1Repository PoCs
GitHubang3lL/CVE-2025-66177Repository PoCby ang3lLStars: 2Exploit2 files
Analysis
Technical assessment
A Metasploit module that exploits an unauthenticated buffer overflow in the Hikvision SADP protocol to achieve remote code execution. It sends crafted UDP packets containing ROP chains and shellcode to vulnerable devices.
Backdoor review
No backdoor observed in reviewed code
The supplied evidence consists of a Metasploit module and a README file. The module is a standard exploit for CVE-2025-66177, a buffer overflow in Hikvision SADP. It sends crafted UDP packets to trigger RCE and uses a Metasploit-generated reverse shell payload. No concealed backdoor, unrelated payload, credential theft, persistence, or deceptive behavior was observed. The code's functionality is consistent with its stated purpose.
ClassificationExploit
Model confidence98%
AuthenticationNot required
Languages
Target software
Attack types
Evidence & reasoningClassification basis · observed behavior · safety review
Classification basis and observed behavior
Classification basis
The artifact is a complete Metasploit module that actively exploits a buffer overflow vulnerability to execute arbitrary code on a remote target. It constructs and sends malicious payloads (ROP chains and shellcode) to achieve remote code execution, which is the definition of an exploit.
metasploit_sadp_exchange.rb:11metasploit_sadp_exchange.rb:18-23metasploit_sadp_exchange.rb:191-233metasploit_sadp_exchange.rb:235-311Requirements
- Attacker must be on the same LAN as the target device.
metasploit_sadp_exchange.rb:20-23 - Target must be running a vulnerable Hikvision firmware version (e.g., 4.83 or 4.72).
metasploit_sadp_exchange.rb:20-22metasploit_sadp_exchange.rb:173-187 - Metasploit Framework must be installed and configured with a payload (e.g., reverse shell).
metasploit_sadp_exchange.rb:2metasploit_sadp_exchange.rb:35-36
Observed behavior
- Sends a multicast SADP inquiry to discover Hikvision devices on the LAN.
metasploit_sadp_exchange.rb:141-162 - Parses device responses to extract MAC address and firmware version.
metasploit_sadp_exchange.rb:164-171 - Checks if the firmware version is in the configured vulnerable list.
metasploit_sadp_exchange.rb:314-317 - For firmware 4.83, constructs a buffer overflow payload with a ROP chain and custom ARM shellcode, then sends it via a crafted SADP exchangecode packet.
metasploit_sadp_exchange.rb:191-233 - For firmware 4.72, leaks a libc address, calculates the base, constructs a ROP chain to call mprotect, and sends shellcode via a crafted SADP exchangecode packet.
metasploit_sadp_exchange.rb:235-311 - The shellcode embedded in the payloads establishes a reverse TCP connection to the attacker's machine and executes /bin/sh.
metasploit_sadp_exchange.rb:81-109metasploit_sadp_exchange.rb:111-139
Behaviors behind the backdoor verdict
Observables
- Exploit Payload
- linux/armle/shell_reverse_tcpThe default Metasploit payload configured in the module, which establishes a reverse shell connection back to the attacker.
metasploit_sadp_exchange.rb:36 - Network Behavior
- Sends crafted UDP packets to port 37020 on multicast address 239.255.255.250The exploit sends SADP protocol packets to trigger the buffer overflow and deliver the payload.
metasploit_sadp_exchange.rb:45-46metasploit_sadp_exchange.rb:227-229 - Shellcode
- Embedded ARM shellcode in make_custom_shellcode483 and make_custom_shellcode472The module contains hardcoded ARM shellcode that executes /bin/sh and connects back to the attacker's LHOST/LPORT.
metasploit_sadp_exchange.rb:92-105metasploit_sadp_exchange.rb:122-135
What the analysis did not establish
- The evidence includes only the source code of the Metasploit module and a README; no execution logs, network captures, or target device responses are provided to confirm the exploit's effectiveness.
- The analysis is based solely on static review of the provided text files; the code was not executed, and its behavior on a live system is not verified.
- Review is limited to the supplied text files; no binary files were present or analyzed.
- The hardcoded shellcode was not disassembled or executed, but its structure (including '/bin/sh' string and reverse connection logic) is consistent with a standard reverse shell payload.
Model interpretation
This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.
References
2hikvision.com
https://www.hikvision.com/en/support/cybersecurity/security-advisory/buffer-overflow-vulnerabilities-in-some-hikvision-products