VulnerabilityDeferred

CVE-2025-34058

Hikvision Streaming Media Management Server v2.3.5 uses default credentials that allow remote attackers to authenticate and access restricted functionality.

HIGH 8.7EPSS 0.86%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.86%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Hikvision Streaming Media Management Server v2.3.5 uses default credentials that allow remote attackers to authenticate and access restricted functionality. After authenticating with these credentials, an attacker can exploit an arbitrary file read vulnerability in the /systemLog/downFile.php endpoint via directory traversal in the fileName parameter. This exploit chain can enable unauthorized access to sensitive system files.

CVSS 4.0: 8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.86% probability · 56th percentile
CISA KEV: Not listed
Weakness: CWE-22, CWE-521
Source: disclosure@vulncheck.com

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.