CVE-2025-34067: Hikvision Integrated Security Management Platform Remote Command Execution via applyCT Fastjson
An unauthenticated remote command execution vulnerability exists in the applyCT component of the Hikvision Integrated Security Management Platform due to the use of a vulnerable version of the Fastjson library. The endpoint /bic/ssoService/v1/applyCT deserializes untrusted user input, allowing an attacker to trigger Fastjson's auto-type feature to load arbitrary Java classes. By referencing a malicious class via an LDAP URL, an attacker can achieve remote code execution on the underlying system. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34067?
CVE-2025-34067 is rated as a critical vulnerability due to its potential for unauthenticated remote command execution.
How do I fix CVE-2025-34067?
To mitigate CVE-2025-34067, update the Hikvision Integrated Security Management Platform to a version that does not use the vulnerable Fastjson library.
What is affected by CVE-2025-34067?
CVE-2025-34067 affects the applyCT component of the Hikvision HikCentral software.
Can CVE-2025-34067 be exploited remotely?
Yes, CVE-2025-34067 can be exploited remotely due to the vulnerability's exposure in an unauthenticated manner.
What are the potential impacts of CVE-2025-34067?
The potential impacts of CVE-2025-34067 include unauthorized remote command execution, which could lead to system compromise.