CVE-2025-66177

Published Jan 13, 2026 CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Description
There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision NVR/DVR/CVR/IPC models. If exploited, an attacker on the same local area network (LAN) could cause the device to malfunction by sending specially crafted packets to an unpatched device.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description There is a Stack overflow Vulnerability in the device Search and Discovery feature of Hikvision NVR/DVR/CVR/IPC models. If exploited, an attacker on the same local area network (LAN) could cause the device to malfunction by sending specially crafted packets to an unpatched device. There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision NVR/DVR/CVR/IPC models. If exploited, an attacker on the same local area network (LAN) could cause the device to malfunction by sending specially crafted packets to an unpatched device.
Type Values Removed Values Added
First Time appeared Hikvision
Hikvision ds-2cd1xx1
Hikvision ds-2cd1xxxg0(t)
Hikvision ds-2cd1xxxg2
Hikvision ds-2cd29xxg0
Hikvision ds-2cd2dx5g1
Hikvision ds-2cd2xx1g0
Hikvision ds-2cd3xx1g0
Hikvision ds-2cd3xx1g2
Hikvision ds-2cd64x5g1
Hikvision ds-2xc6xxxg0
Hikvision ds-2xe6xxxg0
Hikvision ds-710xni-g1/(xp)/m
Hikvision ds-71xxhghi-m1(/t)
Hikvision ds-71xxni-q1(/xp)
Hikvision ds-71xxni-q1(/xp)/m
Hikvision ds-72xxhghi-m1(/t)
Hikvision ds-76xxni-mx
Hikvision ds-76xxni-q1(/xp)
Hikvision ds-76xxni-q2(/xp)
Hikvision ds-76xxni-qx(/xp)
Hikvision ds-76xxnxi-ix/s
Hikvision ds-76xxnxi-ix/vpro
Hikvision ds-76xxnxi-k1(/xp)
Hikvision ds-76xxnxi-k1(/xp)/vpro
Hikvision ds-76xxnxi-k2(/xp)
Hikvision ds-76xxnxi-k2(/xp)/vpro
Hikvision ds-76xxnxi-kx(/xp)
Hikvision ds-76xxnxi-kx(/xp)/vpro
Hikvision ds-76xxnxi-mx/vpro
Hikvision ds-77xxni-mx
Hikvision ds-77xxnxi-ix/s
Hikvision ds-77xxnxi-ix/vpro
Hikvision ds-77xxnxi-k4(/xp)
Hikvision ds-77xxnxi-k4(/xp)/vpro
Hikvision ds-77xxnxi-kx(/xp)
Hikvision ds-77xxnxi-kx(/xp)/vpro
Hikvision ds-86xxnxi-ix/s
Hikvision ds-86xxnxi-k8(/xp)
Hikvision ds-86xxxnxi-mx
Hikvision ds-96xxnxi-ix/s
Hikvision ds-96xxnxi-mx
Hikvision ds-96xxnxi-mx/vpro
Hikvision ds-96xxnxi-sx
Hikvision ds-96xxxni-hx
Hikvision ds-96xxxni-ix
Hikvision ds-96xxxnxi-mx
Hikvision ds-96xxxnxi-sx
Hikvision ds-a806xxsi
Hikvision ds-at1000si
Hikvision ds-exxhghi-xx
Hikvision hwi-xxxh(c)
Hikvision hwi-xxxxha
Hikvision ids-6704nxi/ai
Hikvision ids-67xxnxi-mx/ai
Hikvision ids-67xxnxi-mx/x
Hikvision ids-67xxnxi-p1
Hikvision ids-67xxnxi-s
Hikvision ids-67xxnxi-s/t
Hikvision ids-67xxxnxi-mx/ai
Hikvision ids-71xxhghi-m1(/t)
Hikvision ids-71xxhqhi-m1(/t)
Hikvision ids-71xxhqhi-m1/s
Hikvision ids-71xxhqhi-m1/t
Hikvision ids-71xxhuhi-m1/s
Hikvision ids-72xxhghi-m1(/t)
Hikvision ids-72xxhqhi-m1(/t)
Hikvision ids-72xxhqhi-m1/e
Hikvision ids-72xxhqhi-m1/t
Hikvision ids-72xxhqhi-mx/xt
Hikvision ids-72xxhthi-mx/xt
Hikvision ids-72xxhuhi-m1/e
Hikvision ids-72xxhuhi-m1/t
Hikvision ids-72xxhuhi-mx/pxt
Hikvision ids-72xxhuhi-mx/x
Hikvision ids-72xxhuhi-mx/xt
Hikvision ids-73xxhqhi-m4/s
Hikvision ids-73xxhuhi-m4/s
Hikvision ids-73xxhuhi-m4/s(s)
Hikvision ids-7608nxi-p2
Hikvision ids-76xxnxi-mx/x
Hikvision ids-77xxnxi-mx/x
Hikvision ids-77xxnxi-p4
Hikvision ids-81xxhqhi-m8/s
Hikvision ids-81xxhuhi-m8/s(s)
Hikvision ids-90xxhqhi-m8/s
Hikvision ids-90xxhuhi-m8/s
Hikvision ids-90xxhuhi-m8/s(s)
Hikvision ids-96064nxi-i16
Hikvision ids-96xxnxi-mx/ai
Hikvision ids-96xxnxi-mx/x
Hikvision ids-96xxnxi-px
Hikvision ids-96xxxnxi-hx
Hikvision ids-96xxxnxi-hx/ai
Hikvision ids-96xxxnxi-ix/ai
Hikvision ids-96xxxnxi-mx/x
Hikvision ids-exxhqhi-xx
Hikvision ids-exxhuhi-xx
Hikvision ipc-xxxxh
Hikvision ipc-xxxxha
Vendors & Products Hikvision
Hikvision ds-2cd1xx1
Hikvision ds-2cd1xxxg0(t)
Hikvision ds-2cd1xxxg2
Hikvision ds-2cd29xxg0
Hikvision ds-2cd2dx5g1
Hikvision ds-2cd2xx1g0
Hikvision ds-2cd3xx1g0
Hikvision ds-2cd3xx1g2
Hikvision ds-2cd64x5g1
Hikvision ds-2xc6xxxg0
Hikvision ds-2xe6xxxg0
Hikvision ds-710xni-g1/(xp)/m
Hikvision ds-71xxhghi-m1(/t)
Hikvision ds-71xxni-q1(/xp)
Hikvision ds-71xxni-q1(/xp)/m
Hikvision ds-72xxhghi-m1(/t)
Hikvision ds-76xxni-mx
Hikvision ds-76xxni-q1(/xp)
Hikvision ds-76xxni-q2(/xp)
Hikvision ds-76xxni-qx(/xp)
Hikvision ds-76xxnxi-ix/s
Hikvision ds-76xxnxi-ix/vpro
Hikvision ds-76xxnxi-k1(/xp)
Hikvision ds-76xxnxi-k1(/xp)/vpro
Hikvision ds-76xxnxi-k2(/xp)
Hikvision ds-76xxnxi-k2(/xp)/vpro
Hikvision ds-76xxnxi-kx(/xp)
Hikvision ds-76xxnxi-kx(/xp)/vpro
Hikvision ds-76xxnxi-mx/vpro
Hikvision ds-77xxni-mx
Hikvision ds-77xxnxi-ix/s
Hikvision ds-77xxnxi-ix/vpro
Hikvision ds-77xxnxi-k4(/xp)
Hikvision ds-77xxnxi-k4(/xp)/vpro
Hikvision ds-77xxnxi-kx(/xp)
Hikvision ds-77xxnxi-kx(/xp)/vpro
Hikvision ds-86xxnxi-ix/s
Hikvision ds-86xxnxi-k8(/xp)
Hikvision ds-86xxxnxi-mx
Hikvision ds-96xxnxi-ix/s
Hikvision ds-96xxnxi-mx
Hikvision ds-96xxnxi-mx/vpro
Hikvision ds-96xxnxi-sx
Hikvision ds-96xxxni-hx
Hikvision ds-96xxxni-ix
Hikvision ds-96xxxnxi-mx
Hikvision ds-96xxxnxi-sx
Hikvision ds-a806xxsi
Hikvision ds-at1000si
Hikvision ds-exxhghi-xx
Hikvision hwi-xxxh(c)
Hikvision hwi-xxxxha
Hikvision ids-6704nxi/ai
Hikvision ids-67xxnxi-mx/ai
Hikvision ids-67xxnxi-mx/x
Hikvision ids-67xxnxi-p1
Hikvision ids-67xxnxi-s
Hikvision ids-67xxnxi-s/t
Hikvision ids-67xxxnxi-mx/ai
Hikvision ids-71xxhghi-m1(/t)
Hikvision ids-71xxhqhi-m1(/t)
Hikvision ids-71xxhqhi-m1/s
Hikvision ids-71xxhqhi-m1/t
Hikvision ids-71xxhuhi-m1/s
Hikvision ids-72xxhghi-m1(/t)
Hikvision ids-72xxhqhi-m1(/t)
Hikvision ids-72xxhqhi-m1/e
Hikvision ids-72xxhqhi-m1/t
Hikvision ids-72xxhqhi-mx/xt
Hikvision ids-72xxhthi-mx/xt
Hikvision ids-72xxhuhi-m1/e
Hikvision ids-72xxhuhi-m1/t
Hikvision ids-72xxhuhi-mx/pxt
Hikvision ids-72xxhuhi-mx/x
Hikvision ids-72xxhuhi-mx/xt
Hikvision ids-73xxhqhi-m4/s
Hikvision ids-73xxhuhi-m4/s
Hikvision ids-73xxhuhi-m4/s(s)
Hikvision ids-7608nxi-p2
Hikvision ids-76xxnxi-mx/x
Hikvision ids-77xxnxi-mx/x
Hikvision ids-77xxnxi-p4
Hikvision ids-81xxhqhi-m8/s
Hikvision ids-81xxhuhi-m8/s(s)
Hikvision ids-90xxhqhi-m8/s
Hikvision ids-90xxhuhi-m8/s
Hikvision ids-90xxhuhi-m8/s(s)
Hikvision ids-96064nxi-i16
Hikvision ids-96xxnxi-mx/ai
Hikvision ids-96xxnxi-mx/x
Hikvision ids-96xxnxi-px
Hikvision ids-96xxxnxi-hx
Hikvision ids-96xxxnxi-hx/ai
Hikvision ids-96xxxnxi-ix/ai
Hikvision ids-96xxxnxi-mx/x
Hikvision ids-exxhqhi-xx
Hikvision ids-exxhuhi-xx
Hikvision ipc-xxxxh
Hikvision ipc-xxxxha
Type Values Removed Values Added
Weaknesses CWE-121
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Type Values Removed Values Added
Description There is a Stack overflow Vulnerability in the device Search and Discovery feature of Hikvision NVR/DVR/CVR/IPC models. If exploited, an attacker on the same local area network (LAN) could cause the device to malfunction by sending specially crafted packets to an unpatched device.
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Hikvision Ds-2cd1xx1 Ds-2cd1xxxg0(t) Ds-2cd1xxxg2 Ds-2cd29xxg0 Ds-2cd2dx5g1 Ds-2cd2xx1g0 Ds-2cd3xx1g0 Ds-2cd3xx1g2 Ds-2cd64x5g1 Ds-2xc6xxxg0 Ds-2xe6xxxg0 Ds-710xni-g1/(xp)/m Ds-71xxhghi-m1(/t) Ds-71xxni-q1(/xp) Ds-71xxni-q1(/xp)/m Ds-72xxhghi-m1(/t) Ds-76xxni-mx Ds-76xxni-q1(/xp) Ds-76xxni-q2(/xp) Ds-76xxni-qx(/xp) Ds-76xxnxi-ix/s Ds-76xxnxi-ix/vpro Ds-76xxnxi-k1(/xp) Ds-76xxnxi-k1(/xp)/vpro Ds-76xxnxi-k2(/xp) Ds-76xxnxi-k2(/xp)/vpro Ds-76xxnxi-kx(/xp) Ds-76xxnxi-kx(/xp)/vpro Ds-76xxnxi-mx/vpro Ds-77xxni-mx Ds-77xxnxi-ix/s Ds-77xxnxi-ix/vpro Ds-77xxnxi-k4(/xp) Ds-77xxnxi-k4(/xp)/vpro Ds-77xxnxi-kx(/xp) Ds-77xxnxi-kx(/xp)/vpro Ds-86xxnxi-ix/s Ds-86xxnxi-k8(/xp) Ds-86xxxnxi-mx Ds-96xxnxi-ix/s Ds-96xxnxi-mx Ds-96xxnxi-mx/vpro Ds-96xxnxi-sx Ds-96xxxni-hx Ds-96xxxni-ix Ds-96xxxnxi-mx Ds-96xxxnxi-sx Ds-a806xxsi Ds-at1000si Ds-exxhghi-xx Hwi-xxxh(c) Hwi-xxxxha Ids-6704nxi/ai Ids-67xxnxi-mx/ai Ids-67xxnxi-mx/x Ids-67xxnxi-p1 Ids-67xxnxi-s Ids-67xxnxi-s/t Ids-67xxxnxi-mx/ai Ids-71xxhghi-m1(/t) Ids-71xxhqhi-m1(/t) Ids-71xxhqhi-m1/s Ids-71xxhqhi-m1/t Ids-71xxhuhi-m1/s Ids-72xxhghi-m1(/t) Ids-72xxhqhi-m1(/t) Ids-72xxhqhi-m1/e Ids-72xxhqhi-m1/t Ids-72xxhqhi-mx/xt Ids-72xxhthi-mx/xt Ids-72xxhuhi-m1/e Ids-72xxhuhi-m1/t Ids-72xxhuhi-mx/pxt Ids-72xxhuhi-mx/x Ids-72xxhuhi-mx/xt Ids-73xxhqhi-m4/s Ids-73xxhuhi-m4/s Ids-73xxhuhi-m4/s(s) Ids-7608nxi-p2 Ids-76xxnxi-mx/x Ids-77xxnxi-mx/x Ids-77xxnxi-p4 Ids-81xxhqhi-m8/s Ids-81xxhuhi-m8/s(s) Ids-90xxhqhi-m8/s Ids-90xxhuhi-m8/s Ids-90xxhuhi-m8/s(s) Ids-96064nxi-i16 Ids-96xxnxi-mx/ai Ids-96xxnxi-mx/x Ids-96xxnxi-px Ids-96xxxnxi-hx Ids-96xxxnxi-hx/ai Ids-96xxxnxi-ix/ai Ids-96xxxnxi-mx/x Ids-exxhqhi-xx Ids-exxhuhi-xx Ipc-xxxxh Ipc-xxxxha
Weaknesses

Sources

Status
PUBLISHED
Assigner
hikvision
Published
Updated
Jul 9, 2026, 6:22 AM
Reserved
Nov 24, 2025, 8:59 AM
Status
Deferred
Published
Jan 13, 2026, 3:16 AM
Modified
Jul 9, 2026, 7:16 AM