CVE-2025-34067 Hikvision Integrated Security Management Platform Remote Command Execution via applyCT Fastjson
Unauthenticated attackers can execute arbitrary code on Hikvision Integrated Security Management Platform via unsafe Fastjson deserialization in the applyCT endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-34067?
CVE-2025-34067 is a critical unsafe deserialization vulnerability in Hikvision Integrated Security Management Platform, published on 2 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An unauthenticated remote command execution vulnerability exists in the applyCT component of the Hikvision Integrated Security Management Platform due to the use of a vulnerable version of the Fastjson library. The endpoint /bic/ssoService/v1/applyCT deserializes untrusted user input, allowing an attacker to trigger Fastjson's auto-type feature to load arbitrary Java classes. By referencing a malicious class via an LDAP URL, an attacker can achieve remote code execution on the underlying system. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.
Weakness: CWE-502
Which versions are affected by CVE-2025-34067?
How do I fix CVE-2025-34067?
No fix has been published for CVE-2025-34067 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2025-34067 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-34067 exists.
Sources
Also known as GHSA-ch97-xgvh-p6mh.