Read the docs
TI-2025-40700 Aliases CVE-2025-66176GHSA-3mmv-v6g2-g7c6

Stack-based buffer overflow in Hikvision DS-K1T331

Priority MEDIUM 40CWE-121Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-121 and the CVSS impact.

Summary

There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision Access Control Products. If exploited, an attacker on the same local area network (LAN) could cause the device to malfunction by sending specially crafted packets to an unpatched device.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00468 40th percentileScored 2026-11-07
Fix Fixed DS-K1T331 (Hikvision): V3.7.80DS-K1T341A/K1T341B (Hikvision): V3.7.80+16 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
HikvisionDS-K1T331before V3.7.80V3.7.80Patch availableCNA
HikvisionDS-K1T341A/K1T341Bbefore V3.7.80V3.7.80Patch availableCNA
HikvisionDS-K1T671/K5671before V3.7.80V3.7.80Patch availableCNA
HikvisionDS-K1T672before V3.7.80V3.7.80Patch availableCNA
HikvisionDS-K1T680before V3.7.80V3.7.80Patch availableCNA
HikvisionDS-K1T981before V3.7.80V3.7.80Patch availableCNA
HikvisionDS-K1T341Cbefore V3.3.180V3.3.180Patch availableCNA
HikvisionDS-K1T670/K1T673before V4.48.0V4.48.0Patch availableCNA
HikvisionDS-K1T8003before V1.4.21V1.4.21Patch availableCNA
HikvisionDS-K1T804Abefore V1.4.22V1.4.22Patch availableCNA
HikvisionDS-K1T8003/8004before V1.4.21V1.4.21Patch availableCNA
HikvisionDS-K1T804Abefore V1.4.22V1.4.22Patch availableCNA
HikvisionDS-K1T804Bbefore V1.4.23V1.4.23Patch availableCNA
HikvisionDS-K1T201A/K1T105Abefore V1.3.65V1.3.65Patch availableCNA
HikvisionDS-K1T342/K1T343/K1T344/DS-K1T6QT-F72/F43before V4.48.0V4.48.0Patch availableCNA
HikvisionDS-K1T8005/DS-K1T808before V3.25.40V3.25.40Patch availableCNA
HikvisionDS-K1T320/DS-K1T321before V3.9.40V3.9.40Patch availableCNA
HikvisionDS-K1T323/DS-K1T510before V4.23.41V4.23.41Patch availableCNA
HikvisionDS-K5033before V4.37.40V4.37.40Patch availableCNA
  • DS-K1T331 VendorHikvision Affected before V3.7.80 Fixed in V3.7.80 Patch available CNA
  • DS-K1T341A/K1T341B VendorHikvision Affected before V3.7.80 Fixed in V3.7.80 Patch available CNA
  • DS-K1T671/K5671 VendorHikvision Affected before V3.7.80 Fixed in V3.7.80 Patch available CNA
  • DS-K1T672 VendorHikvision Affected before V3.7.80 Fixed in V3.7.80 Patch available CNA
  • DS-K1T680 VendorHikvision Affected before V3.7.80 Fixed in V3.7.80 Patch available CNA
  • DS-K1T981 VendorHikvision Affected before V3.7.80 Fixed in V3.7.80 Patch available CNA
  • DS-K1T341C VendorHikvision Affected before V3.3.180 Fixed in V3.3.180 Patch available CNA
  • DS-K1T670/K1T673 VendorHikvision Affected before V4.48.0 Fixed in V4.48.0 Patch available CNA
  • DS-K1T8003 VendorHikvision Affected before V1.4.21 Fixed in V1.4.21 Patch available CNA
  • DS-K1T804A VendorHikvision Affected before V1.4.22 Fixed in V1.4.22 Patch available CNA
  • DS-K1T8003/8004 VendorHikvision Affected before V1.4.21 Fixed in V1.4.21 Patch available CNA
  • DS-K1T804A VendorHikvision Affected before V1.4.22 Fixed in V1.4.22 Patch available CNA
  • DS-K1T804B VendorHikvision Affected before V1.4.23 Fixed in V1.4.23 Patch available CNA
  • DS-K1T201A/K1T105A VendorHikvision Affected before V1.3.65 Fixed in V1.3.65 Patch available CNA
  • DS-K1T342/K1T343/K1T344/DS-K1T6QT-F72/F43 VendorHikvision Affected before V4.48.0 Fixed in V4.48.0 Patch available CNA
  • DS-K1T8005/DS-K1T808 VendorHikvision Affected before V3.25.40 Fixed in V3.25.40 Patch available CNA
  • DS-K1T320/DS-K1T321 VendorHikvision Affected before V3.9.40 Fixed in V3.9.40 Patch available CNA
  • DS-K1T323/DS-K1T510 VendorHikvision Affected before V4.23.41 Fixed in V4.23.41 Patch available CNA
  • DS-K5033 VendorHikvision Affected before V4.37.40 Fixed in V4.37.40 Patch available CNA

CPE configurations NVD · 56

CPEVersionsRoleVendor
cpe:2.3:o:hikvision:ds-k1t331_firmware:*:*:*:*:*:*:*:*before 3.7.80VulnerableHikvision
cpe:2.3:h:hikvision:ds-k1t331:-:*:*:*:*:*:*:*not specified by NVDRunning onHikvision
cpe:2.3:o:hikvision:ds-k1t341a_firmware:*:*:*:*:*:*:*:*before 3.7.80VulnerableHikvision
cpe:2.3:h:hikvision:ds-k1t341a:-:*:*:*:*:*:*:*not specified by NVDRunning onHikvision
cpe:2.3:o:hikvision:ds-k1t341b_firmware:*:*:*:*:*:*:*:*before 3.7.80VulnerableHikvision
cpe:2.3:h:hikvision:ds-k1t341b:-:*:*:*:*:*:*:*not specified by NVDRunning onHikvision
cpe:2.3:o:hikvision:ds-k1t671_firmware:*:*:*:*:*:*:*:*before 3.7.80VulnerableHikvision
cpe:2.3:h:hikvision:ds-k1t671:-:*:*:*:*:*:*:*not specified by NVDRunning onHikvision
cpe:2.3:o:hikvision:ds-k5671_firmware:*:*:*:*:*:*:*:*before 3.7.80VulnerableHikvision
cpe:2.3:h:hikvision:ds-k5671:-:*:*:*:*:*:*:*not specified by NVDRunning onHikvision
  • cpe:2.3:o:hikvision:ds-k1t331_firmware:*:*:*:*:*:*:*:* Versions before 3.7.80 Vulnerable ·Hikvision
  • cpe:2.3:h:hikvision:ds-k1t331:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hikvision
  • cpe:2.3:o:hikvision:ds-k1t341a_firmware:*:*:*:*:*:*:*:* Versions before 3.7.80 Vulnerable ·Hikvision
  • cpe:2.3:h:hikvision:ds-k1t341a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hikvision
  • cpe:2.3:o:hikvision:ds-k1t341b_firmware:*:*:*:*:*:*:*:* Versions before 3.7.80 Vulnerable ·Hikvision
  • cpe:2.3:h:hikvision:ds-k1t341b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hikvision
  • cpe:2.3:o:hikvision:ds-k1t671_firmware:*:*:*:*:*:*:*:* Versions before 3.7.80 Vulnerable ·Hikvision
  • cpe:2.3:h:hikvision:ds-k1t671:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hikvision
  • cpe:2.3:o:hikvision:ds-k5671_firmware:*:*:*:*:*:*:*:* Versions before 3.7.80 Vulnerable ·Hikvision
  • cpe:2.3:h:hikvision:ds-k5671:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hikvision
Show 46 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:hikvision:ds-k1t672_firmware:*:*:*:*:*:*:*:*before 3.7.80VulnerableHikvision
cpe:2.3:h:hikvision:ds-k1t672:-:*:*:*:*:*:*:*not specified by NVDRunning onHikvision
cpe:2.3:o:hikvision:ds-k1t680_firmware:*:*:*:*:*:*:*:*before 3.7.80VulnerableHikvision
cpe:2.3:h:hikvision:ds-k1t680:-:*:*:*:*:*:*:*not specified by NVDRunning onHikvision
cpe:2.3:o:hikvision:ds-k1t981_firmware:*:*:*:*:*:*:*:*before 3.7.80VulnerableHikvision
cpe:2.3:h:hikvision:ds-k1t981:-:*:*:*:*:*:*:*not specified by NVDRunning onHikvision
cpe:2.3:o:hikvision:ds-k1t341c_firmware:*:*:*:*:*:*:*:*before 3.3.180VulnerableHikvision
cpe:2.3:h:hikvision:ds-k1t341c:-:*:*:*:*:*:*:*not specified by NVDRunning onHikvision
cpe:2.3:o:hikvision:ds-k1t670_firmware:*:*:*:*:*:*:*:*before 4.48.0VulnerableHikvision
cpe:2.3:h:hikvision:ds-k1t670:-:*:*:*:*:*:*:*not specified by NVDRunning onHikvision
cpe:2.3:o:hikvision:ds-k1t673_firmware:*:*:*:*:*:*:*:*before 4.48.0VulnerableHikvision
cpe:2.3:h:hikvision:ds-k1t673:-:*:*:*:*:*:*:*not specified by NVDRunning onHikvision
cpe:2.3:o:hikvision:ds-k1t8003_firmware:*:*:*:*:*:*:*:*up to 1.4.21VulnerableHikvision
cpe:2.3:h:hikvision:ds-k1t8003:-:*:*:*:*:*:*:*not specified by NVDRunning onHikvision
cpe:2.3:o:hikvision:ds-k1t804a_firmware:*:*:*:*:*:*:*:*before 1.4.22VulnerableHikvision
cpe:2.3:h:hikvision:ds-k1t804a:-:*:*:*:*:*:*:*not specified by NVDRunning onHikvision
cpe:2.3:o:hikvision:ds-k1t804b_firmware:*:*:*:*:*:*:*:*before 1.4.23VulnerableHikvision
cpe:2.3:h:hikvision:ds-k1t804b:-:*:*:*:*:*:*:*not specified by NVDRunning onHikvision
cpe:2.3:o:hikvision:ds-k1t201a_firmware:*:*:*:*:*:*:*:*before 1.3.65VulnerableHikvision
cpe:2.3:h:hikvision:ds-k1t201a:-:*:*:*:*:*:*:*not specified by NVDRunning onHikvision
cpe:2.3:o:hikvision:ds-k1t105a_firmware:*:*:*:*:*:*:*:*before 1.3.65VulnerableHikvision
cpe:2.3:h:hikvision:ds-k1t105a:-:*:*:*:*:*:*:*not specified by NVDRunning onHikvision
cpe:2.3:o:hikvision:ds-k1t342_firmware:*:*:*:*:*:*:*:*before 4.48.0VulnerableHikvision
cpe:2.3:h:hikvision:ds-k1t342:-:*:*:*:*:*:*:*not specified by NVDRunning onHikvision
cpe:2.3:o:hikvision:ds-k1t343_firmware:*:*:*:*:*:*:*:*before 4.48.0VulnerableHikvision
cpe:2.3:h:hikvision:ds-k1t343:-:*:*:*:*:*:*:*not specified by NVDRunning onHikvision
cpe:2.3:o:hikvision:ds-k1t344_firmware:*:*:*:*:*:*:*:*before 4.48.0VulnerableHikvision
cpe:2.3:h:hikvision:ds-k1t344:-:*:*:*:*:*:*:*not specified by NVDRunning onHikvision
cpe:2.3:o:hikvision:ds-k1t6qt-f72_firmware:*:*:*:*:*:*:*:*before 4.48.0VulnerableHikvision
cpe:2.3:h:hikvision:ds-k1t6qt-f72:-:*:*:*:*:*:*:*not specified by NVDRunning onHikvision
cpe:2.3:o:hikvision:ds-k1t6qt-f43_firmware:*:*:*:*:*:*:*:*before 4.48.0VulnerableHikvision
cpe:2.3:h:hikvision:ds-k1t6qt-f43:-:*:*:*:*:*:*:*not specified by NVDRunning onHikvision
cpe:2.3:o:hikvision:ds-k1t8005_firmware:*:*:*:*:*:*:*:*before 3.25.40VulnerableHikvision
cpe:2.3:h:hikvision:ds-k1t8005:-:*:*:*:*:*:*:*not specified by NVDRunning onHikvision
cpe:2.3:o:hikvision:ds-k1t808_firmware:*:*:*:*:*:*:*:*before 3.25.40VulnerableHikvision
cpe:2.3:h:hikvision:ds-k1t808:-:*:*:*:*:*:*:*not specified by NVDRunning onHikvision
cpe:2.3:o:hikvision:ds-k1t320_firmware:*:*:*:*:*:*:*:*before 3.9.40VulnerableHikvision
cpe:2.3:h:hikvision:ds-k1t320:-:*:*:*:*:*:*:*not specified by NVDRunning onHikvision
cpe:2.3:o:hikvision:ds-k1t321_firmware:*:*:*:*:*:*:*:*before 3.9.40VulnerableHikvision
cpe:2.3:h:hikvision:ds-k1t321:-:*:*:*:*:*:*:*not specified by NVDRunning onHikvision
cpe:2.3:o:hikvision:ds-k1t323_firmware:*:*:*:*:*:*:*:*before 4.23.41VulnerableHikvision
cpe:2.3:h:hikvision:ds-k1t323:-:*:*:*:*:*:*:*not specified by NVDRunning onHikvision
cpe:2.3:o:hikvision:ds-k1t510_firmware:*:*:*:*:*:*:*:*before 4.23.41VulnerableHikvision
cpe:2.3:h:hikvision:ds-k1t510:-:*:*:*:*:*:*:*not specified by NVDRunning onHikvision
cpe:2.3:o:hikvision:ds-k5033_firmware:*:*:*:*:*:*:*:*before 4.37.40VulnerableHikvision
cpe:2.3:h:hikvision:ds-k5033:-:*:*:*:*:*:*:*not specified by NVDRunning onHikvision
  • cpe:2.3:o:hikvision:ds-k1t672_firmware:*:*:*:*:*:*:*:* Versions before 3.7.80 Vulnerable ·Hikvision
  • cpe:2.3:h:hikvision:ds-k1t672:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hikvision
  • cpe:2.3:o:hikvision:ds-k1t680_firmware:*:*:*:*:*:*:*:* Versions before 3.7.80 Vulnerable ·Hikvision
  • cpe:2.3:h:hikvision:ds-k1t680:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hikvision
  • cpe:2.3:o:hikvision:ds-k1t981_firmware:*:*:*:*:*:*:*:* Versions before 3.7.80 Vulnerable ·Hikvision
  • cpe:2.3:h:hikvision:ds-k1t981:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hikvision
  • cpe:2.3:o:hikvision:ds-k1t341c_firmware:*:*:*:*:*:*:*:* Versions before 3.3.180 Vulnerable ·Hikvision
  • cpe:2.3:h:hikvision:ds-k1t341c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hikvision
  • cpe:2.3:o:hikvision:ds-k1t670_firmware:*:*:*:*:*:*:*:* Versions before 4.48.0 Vulnerable ·Hikvision
  • cpe:2.3:h:hikvision:ds-k1t670:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hikvision
  • cpe:2.3:o:hikvision:ds-k1t673_firmware:*:*:*:*:*:*:*:* Versions before 4.48.0 Vulnerable ·Hikvision
  • cpe:2.3:h:hikvision:ds-k1t673:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hikvision
  • cpe:2.3:o:hikvision:ds-k1t8003_firmware:*:*:*:*:*:*:*:* Versions up to 1.4.21 Vulnerable ·Hikvision
  • cpe:2.3:h:hikvision:ds-k1t8003:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hikvision
  • cpe:2.3:o:hikvision:ds-k1t804a_firmware:*:*:*:*:*:*:*:* Versions before 1.4.22 Vulnerable ·Hikvision
  • cpe:2.3:h:hikvision:ds-k1t804a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hikvision
  • cpe:2.3:o:hikvision:ds-k1t804b_firmware:*:*:*:*:*:*:*:* Versions before 1.4.23 Vulnerable ·Hikvision
  • cpe:2.3:h:hikvision:ds-k1t804b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hikvision
  • cpe:2.3:o:hikvision:ds-k1t201a_firmware:*:*:*:*:*:*:*:* Versions before 1.3.65 Vulnerable ·Hikvision
  • cpe:2.3:h:hikvision:ds-k1t201a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hikvision
  • cpe:2.3:o:hikvision:ds-k1t105a_firmware:*:*:*:*:*:*:*:* Versions before 1.3.65 Vulnerable ·Hikvision
  • cpe:2.3:h:hikvision:ds-k1t105a:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hikvision
  • cpe:2.3:o:hikvision:ds-k1t342_firmware:*:*:*:*:*:*:*:* Versions before 4.48.0 Vulnerable ·Hikvision
  • cpe:2.3:h:hikvision:ds-k1t342:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hikvision
  • cpe:2.3:o:hikvision:ds-k1t343_firmware:*:*:*:*:*:*:*:* Versions before 4.48.0 Vulnerable ·Hikvision
  • cpe:2.3:h:hikvision:ds-k1t343:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hikvision
  • cpe:2.3:o:hikvision:ds-k1t344_firmware:*:*:*:*:*:*:*:* Versions before 4.48.0 Vulnerable ·Hikvision
  • cpe:2.3:h:hikvision:ds-k1t344:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hikvision
  • cpe:2.3:o:hikvision:ds-k1t6qt-f72_firmware:*:*:*:*:*:*:*:* Versions before 4.48.0 Vulnerable ·Hikvision
  • cpe:2.3:h:hikvision:ds-k1t6qt-f72:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hikvision
  • cpe:2.3:o:hikvision:ds-k1t6qt-f43_firmware:*:*:*:*:*:*:*:* Versions before 4.48.0 Vulnerable ·Hikvision
  • cpe:2.3:h:hikvision:ds-k1t6qt-f43:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hikvision
  • cpe:2.3:o:hikvision:ds-k1t8005_firmware:*:*:*:*:*:*:*:* Versions before 3.25.40 Vulnerable ·Hikvision
  • cpe:2.3:h:hikvision:ds-k1t8005:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hikvision
  • cpe:2.3:o:hikvision:ds-k1t808_firmware:*:*:*:*:*:*:*:* Versions before 3.25.40 Vulnerable ·Hikvision
  • cpe:2.3:h:hikvision:ds-k1t808:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hikvision
  • cpe:2.3:o:hikvision:ds-k1t320_firmware:*:*:*:*:*:*:*:* Versions before 3.9.40 Vulnerable ·Hikvision
  • cpe:2.3:h:hikvision:ds-k1t320:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hikvision
  • cpe:2.3:o:hikvision:ds-k1t321_firmware:*:*:*:*:*:*:*:* Versions before 3.9.40 Vulnerable ·Hikvision
  • cpe:2.3:h:hikvision:ds-k1t321:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hikvision
  • cpe:2.3:o:hikvision:ds-k1t323_firmware:*:*:*:*:*:*:*:* Versions before 4.23.41 Vulnerable ·Hikvision
  • cpe:2.3:h:hikvision:ds-k1t323:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hikvision
  • cpe:2.3:o:hikvision:ds-k1t510_firmware:*:*:*:*:*:*:*:* Versions before 4.23.41 Vulnerable ·Hikvision
  • cpe:2.3:h:hikvision:ds-k1t510:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hikvision
  • cpe:2.3:o:hikvision:ds-k5033_firmware:*:*:*:*:*:*:*:* Versions before 4.37.40 Vulnerable ·Hikvision
  • cpe:2.3:h:hikvision:ds-k5033:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hikvision

Remediation

  • Fix · CNA DS-K1T331 (Hikvision) Fixed in V3.7.80
  • Fix · CNA DS-K1T341A/K1T341B (Hikvision) Fixed in V3.7.80
  • Fix · CNA DS-K1T671/K5671 (Hikvision) Fixed in V3.7.80
  • Fix · CNA DS-K1T672 (Hikvision) Fixed in V3.7.80
  • Fix · CNA DS-K1T680 (Hikvision) Fixed in V3.7.80
  • Fix · CNA DS-K1T981 (Hikvision) Fixed in V3.7.80
  • Fix · CNA DS-K1T341C (Hikvision) Fixed in V3.3.180
  • Fix · CNA DS-K1T670/K1T673 (Hikvision) Fixed in V4.48.0
  • Fix · CNA DS-K1T8003 (Hikvision) Fixed in V1.4.21
  • Fix · CNA DS-K1T804A (Hikvision) Fixed in V1.4.22
  • Fix · CNA DS-K1T8003/8004 (Hikvision) Fixed in V1.4.21
  • Fix · CNA DS-K1T804A (Hikvision) Fixed in V1.4.22
  • Fix · CNA DS-K1T804B (Hikvision) Fixed in V1.4.23
  • Fix · CNA DS-K1T201A/K1T105A (Hikvision) Fixed in V1.3.65
  • Fix · CNA DS-K1T342/K1T343/K1T344/DS-K1T6QT-F72/F43 (Hikvision) Fixed in V4.48.0
  • Fix · CNA DS-K1T8005/DS-K1T808 (Hikvision) Fixed in V3.25.40
  • Fix · CNA DS-K1T320/DS-K1T321 (Hikvision) Fixed in V3.9.40
  • Fix · CNA DS-K1T323/DS-K1T510 (Hikvision) Fixed in V4.23.41
  • Fix · CNA DS-K5033 (Hikvision) Fixed in V4.37.40

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-66176
  2. 2026-10-03 Alias added: GHSA-3mmv-v6g2-g7c6

References

Sources