---
id: CVE-2025-66176
title: >-
  There is a Buffer overflow Vulnerability in the device Search and Discovery
  feature of Hikvision Access Control Products
summary: >-
  There is a Buffer overflow Vulnerability in the device Search and Discovery
  feature of Hikvision Access Control Products. If exploited, an attacker on the
  same local area network (LAN) could cause the device to malfunction by sending
  spe…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-121
vendor: hikvision
product: ds-k1t331_firmware
affected:
  - ds-k1t331_firmware < 3.7.80
  - ds-k1t341a_firmware < 3.7.80
  - ds-k1t341b_firmware < 3.7.80
  - ds-k1t671_firmware < 3.7.80
  - ds-k5671_firmware < 3.7.80
  - ds-k1t672_firmware < 3.7.80
  - ds-k1t680_firmware < 3.7.80
  - ds-k1t981_firmware < 3.7.80
  - ds-k1t341c_firmware < 3.3.180
  - ds-k1t670_firmware < 4.48.0
  - ds-k1t673_firmware < 4.48.0
  - ds-k1t8003_firmware <= 1.4.21
  - ds-k1t804a_firmware < 1.4.22
  - ds-k1t804b_firmware < 1.4.23
  - ds-k1t201a_firmware < 1.3.65
  - ds-k1t105a_firmware < 1.3.65
  - ds-k1t342_firmware < 4.48.0
  - ds-k1t343_firmware < 4.48.0
  - ds-k1t344_firmware < 4.48.0
  - ds-k1t6qt-f72_firmware < 4.48.0
  - ds-k1t6qt-f43_firmware < 4.48.0
  - ds-k1t8005_firmware < 3.25.40
  - ds-k1t808_firmware < 3.25.40
  - ds-k1t320_firmware < 3.9.40
  - ds-k1t321_firmware < 3.9.40
  - ds-k1t323_firmware < 4.23.41
  - ds-k1t510_firmware < 4.23.41
  - ds-k5033_firmware < 4.37.40
patched:
  - ds-k1t331_firmware 3.7.80
  - ds-k1t341a_firmware 3.7.80
  - ds-k1t341b_firmware 3.7.80
  - ds-k1t671_firmware 3.7.80
  - ds-k5671_firmware 3.7.80
  - ds-k1t672_firmware 3.7.80
  - ds-k1t680_firmware 3.7.80
  - ds-k1t981_firmware 3.7.80
  - ds-k1t341c_firmware 3.3.180
  - ds-k1t670_firmware 4.48.0
  - ds-k1t673_firmware 4.48.0
  - ds-k1t804a_firmware 1.4.22
  - ds-k1t804b_firmware 1.4.23
  - ds-k1t201a_firmware 1.3.65
  - ds-k1t105a_firmware 1.3.65
  - ds-k1t342_firmware 4.48.0
  - ds-k1t343_firmware 4.48.0
  - ds-k1t344_firmware 4.48.0
  - ds-k1t6qt-f72_firmware 4.48.0
  - ds-k1t6qt-f43_firmware 4.48.0
  - ds-k1t8005_firmware 3.25.40
  - ds-k1t808_firmware 3.25.40
  - ds-k1t320_firmware 3.9.40
  - ds-k1t321_firmware 3.9.40
  - ds-k1t323_firmware 4.23.41
  - ds-k1t510_firmware 4.23.41
  - ds-k5033_firmware 4.37.40
published: '2026-01-13'
updated: '2026-07-09'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-66176'
references:
  - url: >-
      https://www.hikvision.com/en/support/cybersecurity/security-advisory/buffer-overflow-vulnerabilities-in-some-hikvision-products/
    label: hsrc@hikvision.com
  - url: 'https://www.talosintelligence.com/vulnerability_reports/TALOS-2025-2281'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.00475
epssPercentile: 0.40236
ingestedAt: '2026-07-10T01:55:22.912Z'
---

## Overview

There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision Access Control Products. If exploited, an attacker on the same local area network (LAN) could cause the device to malfunction by sending specially crafted packets to an unpatched device.

## Affected

- `ds-k1t331_firmware < 3.7.80`
- `ds-k1t341a_firmware < 3.7.80`
- `ds-k1t341b_firmware < 3.7.80`
- `ds-k1t671_firmware < 3.7.80`
- `ds-k5671_firmware < 3.7.80`
- `ds-k1t672_firmware < 3.7.80`
- `ds-k1t680_firmware < 3.7.80`
- `ds-k1t981_firmware < 3.7.80`
- `ds-k1t341c_firmware < 3.3.180`
- `ds-k1t670_firmware < 4.48.0`
- `ds-k1t673_firmware < 4.48.0`
- `ds-k1t8003_firmware <= 1.4.21`
- `ds-k1t804a_firmware < 1.4.22`
- `ds-k1t804b_firmware < 1.4.23`
- `ds-k1t201a_firmware < 1.3.65`
- `ds-k1t105a_firmware < 1.3.65`
- `ds-k1t342_firmware < 4.48.0`
- `ds-k1t343_firmware < 4.48.0`
- `ds-k1t344_firmware < 4.48.0`
- `ds-k1t6qt-f72_firmware < 4.48.0`
- `ds-k1t6qt-f43_firmware < 4.48.0`
- `ds-k1t8005_firmware < 3.25.40`
- `ds-k1t808_firmware < 3.25.40`
- `ds-k1t320_firmware < 3.9.40`
- `ds-k1t321_firmware < 3.9.40`
- `ds-k1t323_firmware < 4.23.41`
- `ds-k1t510_firmware < 4.23.41`
- `ds-k5033_firmware < 4.37.40`

## Remediation

Upgrade past the affected range:

- `ds-k1t331_firmware 3.7.80`
- `ds-k1t341a_firmware 3.7.80`
- `ds-k1t341b_firmware 3.7.80`
- `ds-k1t671_firmware 3.7.80`
- `ds-k5671_firmware 3.7.80`
- `ds-k1t672_firmware 3.7.80`
- `ds-k1t680_firmware 3.7.80`
- `ds-k1t981_firmware 3.7.80`
- `ds-k1t341c_firmware 3.3.180`
- `ds-k1t670_firmware 4.48.0`
- `ds-k1t673_firmware 4.48.0`
- `ds-k1t804a_firmware 1.4.22`
- `ds-k1t804b_firmware 1.4.23`
- `ds-k1t201a_firmware 1.3.65`
- `ds-k1t105a_firmware 1.3.65`
- `ds-k1t342_firmware 4.48.0`
- `ds-k1t343_firmware 4.48.0`
- `ds-k1t344_firmware 4.48.0`
- `ds-k1t6qt-f72_firmware 4.48.0`
- `ds-k1t6qt-f43_firmware 4.48.0`
- `ds-k1t8005_firmware 3.25.40`
- `ds-k1t808_firmware 3.25.40`
- `ds-k1t320_firmware 3.9.40`
- `ds-k1t321_firmware 3.9.40`
- `ds-k1t323_firmware 4.23.41`
- `ds-k1t510_firmware 4.23.41`
- `ds-k5033_firmware 4.37.40`