Multiple Hikvision Vulnerabilities Let Attackers Cause Device Malfunction Using Crafted Packets

Hikvision has disclosed two high-severity stack overflow vulnerabilities (CVE-2025-66176 and CVE-2025-66177) in its Search and Discovery feature that allow adjacent-network attackers to cause device crashes; both are rated CVSS 3.1 8.8. The advisory lists affected product families (access control, NVR/DVR/IPC series), recommends immediate firmware updates, network segmentation, and disabling discovery features as mitigations, and cites researchers and vendor links for patches.