Read the docs
TI-2025-24235 Aliases CVE-2025-34067GHSA-ch97-xgvh-p6mh

Hikvision Integrated Security Management Platform Remote Command Execution via applyCT Fastjson

Priority HIGH 76CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

An unauthenticated remote command execution vulnerability exists in the applyCT component of the Hikvision Integrated Security Management Platform due to the use of a vulnerable version of the Fastjson library. The endpoint /bic/ssoService/v1/applyCT deserializes untrusted user input, allowing an attacker to trigger Fastjson's auto-type feature to load arbitrary Java classes. By referencing a malicious class via an LDAP URL, an attacker can achieve remote code execution on the underlying system. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.2197 97th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HikvisionIntegrated Security Management Platformall versions—No fix listedCNA
  • Integrated Security Management Platform VendorHikvision Affected all versions Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-34067
  2. 2026-10-03 Alias added: GHSA-ch97-xgvh-p6mh

References

Exploit 1

Advisory 1

  • TI-2021-14643 A command injection vulnerability in the web server of some Hikvision product. KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-05530 Improper authentication in Hikvision Cameras KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-06300 Hikvision Intercom Broadcasting System ping.php os command injection CVSS 3.1CRITICAL 9.8
  • TI-2024-38371 OS command injection in Hikvision CSMP iSecure Center CVSS 3.1HIGH 8.3
  • TI-2023-29979 Path traversal in Hikvision CSMP iSecure Center CVSS 3.1HIGH 8.3
  • TI-2022-10969 OS command injection in Hikvision… CVSS 3.1CRITICAL 9.8
See all 61 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences