Improper Authentication in Hikvision DVR Products
CVE-2025-66174

6.5MEDIUM

Key Information:

Vendor

Hikvision

Status
Ds-7104hghi-f1
Ds-7204hghi-f1
Vendor
CVE Published:
19 December 2025

What is CVE-2025-66174?

An improper authentication vulnerability exists in certain Hikvision DVR products, arising from inadequate authentication mechanisms for the serial port interface. Attackers with physical access can exploit this vulnerability to connect to the affected devices and execute a series of unauthorized commands, potentially compromising the device's security. Organizations using these Hikvision DVRs should take immediate action to assess their devices and implement protective measures.

Affected Version(s)

DS-7104HGHI-F1 Versions below V4.30.122_201107 (including V4.30.122_201107)

DS-7204HGHI-F1 Versions below V4.30.122_201107 (including V4.30.122_201107)

References

https://www.hikvision.com/en/support/cybersecurity/securi...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Aaron J Jose
JSON
.
CVE-2025-66174 : Improper Authentication in Hikvision DVR Products