CVE-2025-66177

Hikvision network cameras/NVRs/DVRs include a “Search and Discovery” feature that helps devices/services find each other. This bug is like a “too-small bucket” in the software: if someone on the same local network sends carefully crafted messages, the device can behave incorrectly—commonly by crashing or going into a malfunctioning state. If that happens, your recording and viewing may be interrupted until the device is recovered.

This matters if you use one of these Hikvision device models and you have them connected to a network where other devices on the same LAN could send traffic to them. If the device is not updated, a local attacker on your LAN could trigger the problem using crafted packets.

This is primarily a risk when the vulnerable “Search and Discovery” functionality is reachable from the local network and an attacker can send network packets to the device (not something that typically requires an existing login).

This should be treated as an important patching priority. Even though there’s no public exploit code on record and it’s not listed in CISA KEV, the vulnerability can still be triggered from the same LAN and may cause device malfunction, which can directly disrupt your operations. Plan remediation immediately, but it’s not at the “panic now” level based on current public exploitation information.

1. Confirm exposure (model + firmware):

   • In each affected Hikvision device, record the exact model and current firmware/software version.
   • Check whether each device falls into one of the affected models: ds-96xxxni-hx, ds-96xxxni-ix, ds-96xxnxi-sx, ds-96xxxnxi-sx, ds-76xxnxi-mx/vpro, ds-96xxnxi-mx/vpro, ds-76xxni-mx, ds-77xxni-mx, ds-96xxnxi-mx, ds-96xxxnxi-mx.

2. Determine whether a patch exists for your specific firmware branch:

   • Use Hikvision’s official security advisory referenced here to find the corrected firmware versions and which models/versions are affected.

3. Apply the fix:

   • Upgrade to the patched firmware version(s) specified by Hikvision for your exact model.
   • Schedule downtime if needed (firmware upgrades can restart the device).

4. Temporary mitigation if patching is delayed:

   • Reduce who can reach the device on your LAN: limit management/monitoring interfaces to trusted IPs/hosts.
   • Segment the cameras/NVR/DVR network from guest Wi‑Fi or general employee networks so untrusted devices can’t reach it.
   • Disable or restrict any unnecessary “discovery” or network services if your device configuration allows it (align with Hikvision guidance).

5. After updating:

   • Verify the device is stable (no repeated crashes/reboots).
   • Check logs for errors around network discovery/search activity and confirm remote access works as expected.

6. Follow-up monitoring:

   • Monitor for abnormal device restarts, service interruptions, and unusual network traffic to the discovery-related functionality until you fully patch.

Note on exploitation status:

• There is no public exploit code on record and this CVE is not listed in CISA KEV based on the provided findings; however, LAN-reachable bugs can still cause outages, so upgrading remains the right step.

Severity/impact: Rated high (CVSS 8.8). The vulnerability is a buffer overflow (CWE-121) in the “Search and Discovery” feature of certain Hikvision NVR/DVR/CVR/IPC models.

Mechanism: A specially crafted packet sent to an unpatched device from the same local area network (LAN) can trigger the overflow, leading to device malfunction (e.g., crashes or loss of service).

Exploitation maturity: No public exploit code was found in the provided findings, and the vulnerability is not present in CISA KEV. Because the LAN attack precondition is relatively straightforward (local network reachability), affected environments are still considered at meaningful risk for operational disruption.

EPSS: A predicted likelihood value is available in the findings, but it is not used here for public-facing urgency because the provided information indicates no KEV/news confirmation of active exploitation.

KEV meaning: KEV is a list of vulnerabilities CISA has confidence about for active exploitation; since this CVE is not listed there, public exploitation is not confirmed by CISA in the provided findings.