CVE-2025-66177: Hikvision Device Buffer Overflow Flaw

CVE-2025-66177 Overview

A stack overflow vulnerability exists in the device Search and Discovery feature of Hikvision NVR/DVR/CVR/IPC models. This critical firmware vulnerability affects network video recorders, digital video recorders, centralized video recorders, and IP cameras manufactured by Hikvision. If exploited, an attacker on the same local area network (LAN) could cause the device to malfunction by sending specially crafted packets to an unpatched device.

Critical Impact

Attackers on the local network can exploit this stack overflow to cause device malfunction, potentially leading to complete compromise of confidentiality, integrity, and availability of the affected surveillance systems.

Affected Products

• Hikvision Network Video Recorders (NVR)
• Hikvision Digital Video Recorders (DVR)
• Hikvision Centralized Video Recorders (CVR)
• Hikvision IP Cameras (IPC)

Discovery Timeline

• 2026-01-13 - CVE-2025-66177 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2025-66177

Vulnerability Analysis

This vulnerability is classified as CWE-121 (Stack-based Buffer Overflow), a memory corruption issue that occurs when user-controlled input exceeds the allocated buffer size on the stack. The device Search and Discovery feature in affected Hikvision products fails to properly validate the size of incoming network packets before copying data to a fixed-size stack buffer.

The adjacent network attack vector means that an attacker must be on the same local area network as the vulnerable device to exploit this vulnerability. Once in position, the attacker can send specially crafted packets to trigger the overflow condition without requiring any authentication or user interaction.

Root Cause

The root cause is improper bounds checking in the Search and Discovery network service. When processing discovery packets, the firmware copies packet data into a stack-allocated buffer without verifying that the input length does not exceed the buffer capacity. This allows an attacker to overwrite adjacent stack memory, including return addresses and saved registers, potentially leading to arbitrary code execution or device crash.

Attack Vector

The attack requires adjacency to the target network—meaning the attacker must have access to the same LAN segment as the vulnerable Hikvision device. The Search and Discovery feature typically listens on a UDP port for device enumeration requests, making it accessible to any device on the local network.

An attacker would craft a malicious discovery packet with an oversized payload designed to overflow the stack buffer. When the vulnerable device processes this packet, the excess data overwrites critical stack structures. Depending on the payload, this could result in:

• Device crash and denial of service
• Corruption of device configuration
• Potential remote code execution if return addresses are controlled

The attack requires no privileges or authentication, and no user interaction is needed—making it particularly dangerous in environments where network access is not strictly controlled.

Detection Methods for CVE-2025-66177

Indicators of Compromise

• Unexpected device reboots or crashes of Hikvision NVR/DVR/CVR/IPC equipment
• Unusual network traffic patterns on the local network targeting Hikvision discovery ports
• Multiple malformed or oversized UDP packets directed at surveillance devices
• Device configuration changes or loss of recorded footage following suspicious network activity

Detection Strategies

• Deploy network intrusion detection systems (NIDS) to monitor for anomalous traffic patterns targeting Hikvision device discovery services
• Implement packet inspection rules to detect oversized or malformed discovery protocol packets
• Configure alerting for repeated device crashes or unexpected reboots of surveillance equipment
• Monitor for unauthorized devices on network segments containing Hikvision equipment

Monitoring Recommendations

• Enable logging on network switches and firewalls for traffic destined to Hikvision devices
• Implement network segmentation monitoring to detect lateral movement toward surveillance VLANs
• Deploy SentinelOne agents on networked systems to detect attack staging and reconnaissance activities
• Establish baseline network behavior for discovery protocol traffic and alert on deviations

How to Mitigate CVE-2025-66177

Immediate Actions Required

• Apply firmware updates from Hikvision immediately to all affected NVR/DVR/CVR/IPC devices
• Isolate vulnerable Hikvision devices on dedicated network segments with strict access controls
• Disable the Search and Discovery feature if not required for operations
• Implement network access controls to restrict which devices can communicate with surveillance equipment
• Review and audit all devices on network segments containing vulnerable Hikvision equipment

Patch Information

Hikvision has released security patches to address this buffer overflow vulnerability. Administrators should consult the Hikvision Security Advisory for the complete list of affected firmware versions and download the appropriate updates for their specific device models.

Firmware updates should be applied during a scheduled maintenance window, and devices should be backed up prior to updating. After patching, verify device functionality and confirm the new firmware version is installed correctly.

Workarounds

• Implement VLAN segmentation to isolate surveillance devices from general network traffic
• Configure firewall rules to block untrusted hosts from accessing device discovery services
• Disable the Search and Discovery feature via device configuration if the functionality is not required
• Deploy network access control (NAC) to prevent unauthorized devices from joining surveillance network segments

# Network segmentation example - isolate surveillance devices
# Create dedicated VLAN for Hikvision devices
vlan 100
  name SURVEILLANCE_DEVICES
  
# Apply access control list to restrict discovery traffic
ip access-list extended HIKVISION_PROTECT
  permit udp host <management_station> any eq 37020
  deny udp any any eq 37020
  permit ip any any
  
# Apply ACL to VLAN interface
interface vlan 100
  ip access-group HIKVISION_PROTECT in