Hikvision Streaming Media Management Server Default Credentials and Authenticated Arbitrary File Read
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure, Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-22, CWE-521 and the CVSS impact.
Summary
Hikvision Streaming Media Management Server v2.3.5 uses default credentials that allow remote attackers to authenticate and access restricted functionality. After authenticating with these credentials, an attacker can exploit an arbitrary file read vulnerability in the /systemLog/downFile.php endpoint via directory traversal in the fileName parameter. This exploit chain can enable unauthorized access to sensitive system files.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Hangzhou Hikvision System Technology | Streaming Media Management Server | 2.3.5 | — | No fix listed | CNA |
- Streaming Media Management Server VendorHangzhou Hikvision System Technology Affected 2.3.5 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-34058
- 2026-10-03 Alias added: GHSA-fxxf-77p3-7rr7
References
Sources
- CVE-2025-34058 · CVE Program
- CVE-2025-34058 · NVD
- FIRST EPSS
- GHSA-fxxf-77p3-7rr7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences