CVE-2025-66177

High

Published: 13 January 2026

Published

13 January 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0001 1.8th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-66177 is a high-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Hikvision NVR (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation of Remote Services (T1210); ranked at the 1.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation of Remote Services (T1210). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly mitigates the CVE by requiring identification, reporting, and timely correction of the stack overflow flaw through vendor-provided patches.

SI-10 Information Input Validation good match

prevent

Prevents exploitation of the stack overflow by validating specially crafted packets received by the device Search and Discovery feature.

SI-16 Memory Protection partial match

prevent

Mitigates stack overflow impacts by implementing memory protections such as stack guards and address space randomization against unauthorized memory modification.

MITRE ATT&CK Enterprise TechniquesAI

T1210 Exploitation of Remote Services Lateral Movement

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.

attack.mitre.org →

Why these techniques?

Stack overflow in network-accessible Search/Discovery service allows unauthenticated remote exploitation on LAN, directly mapping to exploitation of remote services for code execution or DoS.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

There is a Stack overflow Vulnerability in the device Search and Discovery feature of Hikvision NVR/DVR/CVR/IPC models. If exploited, an attacker on the same local area network (LAN) could cause the device to malfunction by sending specially crafted packets to…

an unpatched device.

Deeper analysisAI

CVE-2025-66177 is a stack overflow vulnerability (CWE-121) affecting the device Search and Discovery feature in Hikvision NVR/DVR/CVR/IPC models. Published on 2026-01-13, it carries a CVSS v3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity with potential impacts on confidentiality, integrity, and availability.

An unauthenticated attacker on the same local area network (LAN) can exploit the vulnerability by sending specially crafted packets to an unpatched device, causing it to malfunction.

The Hikvision security advisory provides details on mitigation for this and related buffer overflow vulnerabilities: https://www.hikvision.com/en/support/cybersecurity/security-advisory/buffer-overflow-vulnerabilities-in-some-hikvision-products/.