{"id":"CVE-2025-34067","published":"2025-07-02T13:44:21Z","modified":"2026-07-14T22:25:42Z","title":"Hikvision Integrated Security Management Platform Remote Command Execution via applyCT Fastjson","vendor":"Hikvision","product":"Integrated Security Management Platform","tier":"core","eol":null,"affectedVersions":[{"vendor":"Hikvision","product":"Integrated Security Management Platform","versions":["0"]}],"description":{"text":"An unauthenticated remote command execution vulnerability exists in the applyCT component of the Hikvision Integrated Security Management Platform due to the use of a vulnerable version of the Fastjson library. The endpoint /bic/ssoService/v1/applyCT deserializes untrusted user input, allowing an attacker to trigger Fastjson's auto-type feature to load arbitrary Java classes. By referencing a malicious class via an LDAP URL, an attacker can achieve remote code execution on the underlying system. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.","provenance":"source","from":"CVE.org"},"summary":{"text":"The Hikvision Integrated Security Management Platform contains a remote command execution flaw in its applyCT component, caused by a vulnerable version of the Fastjson library that deserializes untrusted input at the /bic/ssoService/v1/applyCT endpoint. An unauthenticated attacker with network access to that endpoint can abuse Fastjson's auto-type feature to load a malicious class via an LDAP URL and execute arbitrary commands on the underlying system, with no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T05:10:31Z"},"cvss":{"score":10,"severity":"CRITICAL","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.2197,"percentile":0.97655,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-07-02","exploitedFirstSeen":"2025-07-02","ransomware":false,"evidence":[{"url":"https://www.cve.org/CVERecord?id=CVE-2025-34067","date":"2025-07-02"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-01-21&host_type=src&vulnerability=cve-2025-34067","date":"2026-01-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-01-22&host_type=src&vulnerability=cve-2025-34067","date":"2026-01-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-01-23&host_type=src&vulnerability=cve-2025-34067","date":"2026-01-23"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-01-24&host_type=src&vulnerability=cve-2025-34067","date":"2026-01-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-01-25&host_type=src&vulnerability=cve-2025-34067","date":"2026-01-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-01-26&host_type=src&vulnerability=cve-2025-34067","date":"2026-01-26"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-01-27&host_type=src&vulnerability=cve-2025-34067","date":"2026-01-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-01-28&host_type=src&vulnerability=cve-2025-34067","date":"2026-01-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-01-29&host_type=src&vulnerability=cve-2025-34067","date":"2026-01-29"}],"evidenceTotal":116,"provenance":"source"},"exploited":true,"otx":{"pulseCount":1,"pulses":[{"name":"MuddyWater (Seedworm): Dindoor + Fakeset Backdoors Targeting US Critical Infrastructure","url":"https://otx.alienvault.com/pulse/69aed5a4fef4564e854b99d7","created":"2026-03-09"}],"provenance":"machine"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/iot/HIKVISION/HIKVISION%20%E7%BB%BC%E5%90%88%E5%AE%89%E9%98%B2%E7%AE%A1%E7%90%86%E5%B9%B3%E5%8F%B0%20applyCT%20Fastjson%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md","tags":["exploit"]},{"url":"https://s4e.io/tools/hikvision-applyct-remote-code-execution","tags":["third-party-advisory"]},{"url":"https://vulncheck.com/advisories/hikvision-ismp-rce-applyct","tags":["third-party-advisory"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-19719","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-19719","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":["https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/iot/HIKVISION/HIKVISION%20%E7%BB%BC%E5%90%88%E5%AE%89%E9%98%B2%E7%AE%A1%E7%90%86%E5%B9%B3%E5%8F%B0%20applyCT%20Fastjson%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md"],"flow":[],"timeline":[{"date":"2025-07-02","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-34067","provenance":"source"},{"date":"2025-07-02","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cve.org/CVERecord?id=CVE-2025-34067","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":67.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 486 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.53,"detail":"percentile 0.9766"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":7.0,"detail":"base score 10"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}