Not scored
CVE-2025-34067
Hikvision Integrated Security Management Platform Remote Command Execution via applyCT Fastjson
HikvisionIntegrated Security Management Platform
Status
- Not in CISA KEV
Exploit probabilityEPSSchecked 25 Oct
22%probability of exploitation in the next 30 days
Higher than 98% of scored CVEs
SeverityCVSS
–Not scored yet
Description NVD
An unauthenticated remote command execution vulnerability exists in the applyCT component of the Hikvision Integrated Security Management Platform due to the use of a vulnerable version of the Fastjson library. The endpoint /bic/ssoService/v1/applyCT deserializes untrusted user input, allowing an attacker to trigger Fastjson's auto-type feature to load arbitrary Java classes. By referencing a malicious class via an LDAP URL, an attacker can achieve remote code execution on the underlying system. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.
Coverage 3 articles · 3 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 4 Mar · 03:57 UTC | Check Point | Iranian actors exploit Hikvision and Dahua IP cameras via CVEs |
| Fri 6 Mar · 14:34 UTC | Dark Reading | Iran weaponises cameras with CVEs to plan missile strikes |
| Sat 7 Mar · 10:55 UTC | Security Affairs | Iran-linked actors scan Hikvision and Dahua cams via VPN for CVEs |
- Iran-linked actors scan Hikvision and Dahua cams via VPN for CVEsSecurity Affairs · mentions it in passing
- Iran weaponises cameras with CVEs to plan missile strikesDark Reading · mentions it in passing
- Iranian actors exploit Hikvision and Dahua IP cameras via CVEsCheck Point · first in our coverage · mentions it in passing