Summaryinfo

A vulnerability was found in Hikvision HikCentral and classified as very critical. Affected by this issue is some unknown functionality of the file /bic/ssoService/v1/applyCT of the component Fastjson Library. The manipulation leads to deserialization. This vulnerability is handled as CVE-2025-34067. The attack may be launched remotely. There is no exploit available. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Detailsinfo

A vulnerability has been found in Hikvision HikCentral (affected version not known) and classified as very critical. Affected by this vulnerability is some unknown functionality of the file /bic/ssoService/v1/applyCT of the component Fastjson Library. The manipulation with an unknown input leads to a deserialization vulnerability. The CWE definition for the vulnerability is CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An unauthenticated remote command execution vulnerability exists in the applyCT component of the Hikvision Integrated Security Management Platform due to the use of a vulnerable version of the Fastjson library. The endpoint /bic/ssoService/v1/applyCT deserializes untrusted user input, allowing an attacker to trigger Fastjson's auto-type feature to load arbitrary Java classes. By referencing a malicious class via an LDAP URL, an attacker can achieve remote code execution on the underlying system.

This vulnerability is known as CVE-2025-34067 since 04/15/2025. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 07/07/2025).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-19719). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Hikvision

Name

• HikCentral

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion