CVE-2025-34067: Hikvision Platform RCE Vulnerability

CVE-2025-34067 Overview

An unauthenticated remote command execution vulnerability exists in the applyCT component of the Hikvision Integrated Security Management Platform (ISMP) due to the use of a vulnerable version of the Fastjson library. The endpoint /bic/ssoService/v1/applyCT deserializes untrusted user input, allowing an attacker to trigger Fastjson's auto-type feature to load arbitrary Java classes. By referencing a malicious class via an LDAP URL, an attacker can achieve remote code execution on the underlying system.

Critical Impact

This vulnerability allows unauthenticated attackers to execute arbitrary commands remotely on affected Hikvision security management systems, potentially compromising entire surveillance infrastructure and enabling lateral movement within enterprise networks.

Affected Products

• Hikvision Integrated Security Management Platform (ISMP)
• Hikvision ISMP applyCT Component
• Systems running vulnerable Fastjson library versions

Discovery Timeline

• 2025-02-05 - Exploitation evidence observed by the Shadowserver Foundation
• 2025-07-02 - CVE CVE-2025-34067 published to NVD
• 2025-11-20 - Last updated in NVD database

Technical Details for CVE-2025-34067

Vulnerability Analysis

This vulnerability (CWE-502: Deserialization of Untrusted Data) stems from insecure deserialization in the Hikvision ISMP platform. The applyCT endpoint accepts JSON input and processes it using a vulnerable version of the Fastjson library. Fastjson's auto-type feature automatically instantiates Java classes based on type information embedded in JSON data. When this feature is enabled or insufficiently restricted, attackers can specify arbitrary class names that will be loaded and instantiated during deserialization.

The attack chain involves sending a crafted JSON payload to /bic/ssoService/v1/applyCT that includes a reference to a malicious Java class hosted on an attacker-controlled LDAP server. When the vulnerable Fastjson library processes this input, it follows the LDAP reference, downloads the malicious class, and executes it in the context of the application—achieving full remote code execution without any authentication.

Root Cause

The root cause is twofold: First, the application uses a vulnerable version of the Fastjson library that does not adequately restrict which classes can be instantiated during deserialization. Second, the /bic/ssoService/v1/applyCT endpoint lacks authentication, allowing any network-accessible attacker to submit malicious payloads. The combination of unauthenticated access and unsafe deserialization creates a trivially exploitable attack surface.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker sends a specially crafted HTTP POST request to the vulnerable endpoint containing a JSON payload with embedded type information pointing to a malicious JNDI/LDAP resource. The exploitation flow typically proceeds as follows:

1. Attacker sets up a malicious LDAP server hosting a weaponized Java class
2. Attacker sends a crafted JSON payload to /bic/ssoService/v1/applyCT with a @type field referencing the LDAP URL
3. The Fastjson library processes the input and attempts to resolve the LDAP reference
4. The malicious class is fetched and instantiated, executing arbitrary code on the server

This exploitation pattern is similar to other Fastjson vulnerabilities and JNDI injection attacks. For detailed technical analysis and proof-of-concept information, refer to the VulnCheck HIKVISION Advisory and the GitHub HIKVISION Security Guide.

Detection Methods for CVE-2025-34067

Indicators of Compromise

• HTTP POST requests to /bic/ssoService/v1/applyCT containing @type JSON fields with suspicious class names
• Outbound LDAP or RMI connections from the Hikvision ISMP server to external or unusual IP addresses
• Presence of unexpected Java processes or child processes spawned by the ISMP application
• Web server logs showing requests to the vulnerable endpoint with encoded or obfuscated JSON payloads

Detection Strategies

• Deploy web application firewall (WAF) rules to detect and block Fastjson auto-type exploitation patterns, specifically looking for @type fields in JSON payloads
• Monitor network traffic for outbound LDAP (port 389/636) and RMI (port 1099) connections originating from the ISMP server
• Implement intrusion detection signatures for known Fastjson exploitation payloads and JNDI injection patterns
• Enable verbose logging on the ISMP application and correlate access logs with security events

Monitoring Recommendations

• Continuously monitor access logs for the /bic/ssoService/v1/applyCT endpoint, alerting on anomalous request patterns or volumes
• Set up network segmentation monitoring to detect unexpected lateral movement from security management systems
• Implement file integrity monitoring on the ISMP server to detect unauthorized changes or new file creations
• Configure SIEM rules to correlate Hikvision ISMP events with threat intelligence feeds tracking exploitation of this vulnerability

How to Mitigate CVE-2025-34067

Immediate Actions Required

• Immediately restrict network access to the /bic/ssoService/v1/applyCT endpoint using firewall rules or network segmentation
• Block outbound LDAP and RMI connections from Hikvision ISMP servers to untrusted destinations
• If the system is internet-facing, remove it from public access until patched
• Audit systems for signs of compromise, particularly checking for unauthorized processes or files

Patch Information

Organizations should contact Hikvision support directly to obtain the latest security patches for the Integrated Security Management Platform. Ensure the Fastjson library is updated to a version that properly restricts auto-type deserialization (version 1.2.83 or later recommended). For additional guidance, review the VulnCheck HIKVISION Advisory.

Workarounds

• Implement network-level access controls to restrict access to the ISMP platform to authorized management hosts only
• Deploy a reverse proxy or WAF in front of the ISMP application configured to block requests containing Fastjson auto-type patterns
• Disable or restrict the vulnerable applyCT functionality if not required for operations
• Consider isolating the ISMP server in a dedicated security VLAN with strict egress filtering

# Example iptables rules to restrict access to vulnerable endpoint
# Block external access to the ISMP web interface
iptables -A INPUT -p tcp --dport 443 -s ! 10.0.0.0/8 -j DROP

# Block outbound LDAP connections from the ISMP server
iptables -A OUTPUT -p tcp --dport 389 -j DROP
iptables -A OUTPUT -p tcp --dport 636 -j DROP
iptables -A OUTPUT -p tcp --dport 1099 -j DROP