CVE-2025-66173
📋 TL;DR
A privilege escalation vulnerability in Hikvision DVR/NVR devices allows attackers with physical access to gain unrestricted shell access via the serial port. This affects organizations using vulnerable Hikvision surveillance equipment where physical security controls are insufficient. The vulnerability stems from improper authentication implementation for serial port access.
💻 Affected Systems
- Hikvision DVR/NVR devices
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attacker to install persistent malware, exfiltrate surveillance footage, pivot to internal networks, or disable security monitoring entirely.
Likely Case
Attacker gains administrative control of the DVR/NVR, potentially accessing recorded footage, modifying system settings, or using the device as a foothold for further attacks.
If Mitigated
Limited impact due to strong physical security controls preventing unauthorized physical access to device serial ports.
🎯 Exploit Status
Exploitation requires physical access and basic serial connection tools (USB-to-serial adapter, terminal software). No authentication bypass needed once physical access obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific firmware versions
Vendor Advisory: https://www.hikvision.com/en/support/cybersecurity/security-advisory/serial-port-privilege-escalation-vulnerabilities-in-some-hikvision-nvr-devices/
Restart Required: Yes
Instructions:
1. Check vendor advisory for affected models. 2. Download latest firmware from Hikvision portal. 3. Backup device configuration. 4. Upload firmware via web interface. 5. Reboot device. 6. Verify firmware version updated.
🔧 Temporary Workarounds
Physical Security Hardening
allPrevent physical access to device serial ports
Serial Port Disable
allDisable serial port functionality if not needed
🧯 If You Can't Patch
- Implement strict physical access controls - lock devices in secure cabinets
- Monitor physical access to device locations and implement surveillance of equipment rooms
🔍 How to Verify
Check if Vulnerable:
Check device model against Hikvision advisory. Attempt serial connection to device port (requires physical access).Check Version:
Check via web interface: System > Maintenance > Version Information or via serial console if accessibleVerify Fix Applied:
Verify firmware version matches patched version from advisory. Attempt serial connection to confirm authentication required.📡 Detection & Monitoring
Log Indicators:
- Serial port access logs (if available)
- Unexpected reboots or configuration changes
Network Indicators:
- Unusual network traffic from DVR/NVR devices
SIEM Query:
Device logs showing configuration changes without authorized maintenance windows