CVE-2025-34067Integrated Security Management Platform Insecure Deserialization
An unauthenticated remote command execution vulnerability exists in the applyCT component of the Hikvision Integrated Security Management Platform due to the use of a vulnerable version of the Fastjson library.
Published Jul 2, 2025 · Updated Jul 14, 2026
Key Facts
Patch immediately- CVE-2025-34067 is a critical-severity vulnerability (CVSS 10.0 v4) affecting Integrated Security Management Platform.
- It is exploited in the wild, listed in CIRCL KEV, Industry KEV feed since Jul 2, 2025. A public exploit is reported by tracking sources, but no code link is listed yet.
- EPSS estimates a 22% probability of exploitation in the next 30 days.
- No fixed version is listed yet; check the vendor advisory for mitigations.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Scores
CVSS v4
10.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (30-day exploit likelihood)
22%
Higher than 97.6% of all scored CVEs
Exploit maturity
None known
ATLAS score
18/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Jul 2, 2025
Federal due date
None
No federal due date
Attributed actors
Exploit & Defence Guidance
Exploit maturity
None known
Public exploit code
0
Proof-of-concept links
In-the-wild evidence
10
Reports of active use
Description
An unauthenticated remote command execution vulnerability exists in the applyCT component of the Hikvision Integrated Security Management Platform due to the use of a vulnerable version of the Fastjson library. The endpoint /bic/ssoService/v1/applyCT deserializes untrusted user input, allowing an attacker to trigger Fastjson's auto-type feature to load arbitrary Java classes.
By referencing a malicious class via an LDAP URL, an attacker can achieve remote code execution on the underlying system. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| CIRCL KEV | Jul 2, 2025 | n/a | Not reported |
| Industry KEV feed | Jul 2, 2025 | n/a | Not reported |
Affected Products
1 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Integrated Security Management Platform | See advisory | n/a |
Timeline
Publicly disclosed
Jul 2, 2025
Added to CIRCL KEV
Jul 2, 2025
Added to Industry KEV feed
Jul 2, 2025
Last updated
Jul 14, 2026
Weakness Type
- CWE-502 Deserialization of Untrusted Data
References
- exploitVulnCheck exploitation report
- exploitVulnCheck exploitation report
- exploitVulnCheck exploitation report
- exploitVulnCheck exploitation report
- exploitVulnCheck exploitation report
FAQ
Common Questions.
An unauthenticated remote command execution vulnerability exists in the applyCT component of the Hikvision Integrated Security Management Platform due to the use of a vulnerable version of the Fastjson library.
Affected: Integrated Security Management Platform. The full list is in the CVE brief.
It is exploited in the wild, listed in CIRCL KEV, Industry KEV feed since Jul 2, 2025.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
A public exploit is reported by tracking sources, but no code link is listed yet.
No fixed version is listed yet; check the vendor advisory for mitigations.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2025-34067 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo