PT-2026-2347 · Hikvision · Hikvision Access Control Products

Matt Wiseman · CVE-2025-66176 · Published 2026-01-12 · Updated 2026-07-09

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Hikvision Access Control Products (affected versions not specified)

Description A stack overflow issue exists in the device Search and Discovery feature of Hikvision Access Control Products. An attacker on the same local area network (LAN) can cause the device to malfunction by sending specially crafted packets to an unpatched device. The issue does not require authentication. Millions of surveillance systems globally may be affected.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

BDU:2026-00380

CVE-2025-66176

Affected Products

Hikvision Access Control Products

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2025-66176 · Security Note
• https://hikvision.com/en/support/cybersecurity/security-advisory/buffer-overflow-vulnerabilities-in-some-hikvision-products · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00380 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66176 · Vendor Advisory
• https://t.me/cveNotify/193166 · Telegram Post
• https://twitter.com/zench4n/status/2011259095744200909 · Twitter Post
• https://twitter.com/vercomsystems/status/2013302689572995297 · Twitter Post
• https://twitter.com/The_Cyber_News/status/2010979318093238521 · Twitter Post
• https://twitter.com/ThreatSynop/status/2011037304157090081 · Twitter Post
• https://twitter.com/sp20_10/status/2010980934024405257 · Twitter Post
• https://twitter.com/CVEnew/status/2010911093258928293 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2010957878367007077 · Twitter Post
• https://twitter.com/PurpleOps_io/status/2034753194920726918 · Twitter Post
• https://talosintelligence.com/vulnerability_reports/TALOS-2025-2281 · Note
• https://twitter.com/ThreatSynop/status/2010974323637375194 · Twitter Post