Hikvision CVE-2025-39240

Risk Assessment Summary: CVSS 7.2 indicates significant impact (all CIA attributes High), but key mitigating factor is PR:H (High Privilege Required). This is NOT a zero-day unauthenticated attack—attackers need valid credentials, substantially reducing real-world exploitation likelihood compared to unauthenticated vulnerabilities. CVSS vector AV:N/AC:L shows network accessibility and low attack complexity once authenticated. Without disclosed EPSS score or KEV/CISA data, exploitation probability cannot be quantitatively assessed, but authenticated RCE on networking equipment (WAPs) is operationally valuable to attackers with internal access or compromised credentials. If public POC exists, risk escalates significantly. The vulnerability is automatable post-authentication (AC:L) and produces total system compromise (technical impact: CRITICAL). Realistic priority: MEDIUM-to-HIGH for organizations with: (1) Hikvision WAP deployments in sensitive network zones, (2) weak credential management, (3) insider threat risk, or (4) multi-factor authentication not enforced on device APIs. Lower priority for organizations with strong network segmentation and credential controls.

Attack Scenario: An attacker with valid WAP credentials (obtained via phishing, credential reuse, or initial compromise of an admin account) connects to the Hikvision WAP's REST API or management interface over HTTPS (AV:N). The attacker sends a specially crafted JSON or binary packet targeting a command execution endpoint (e.g., /api/system/reboot or similar), embedding shell metacharacters or command injection payloads in a parameter field that is insufficiently validated (e.g., 'hostname=id > /tmp/pwned' or 'config=; cat /etc/passwd'). Due to CWE-78 flaw, the application passes this unsanitized input to a system call, executing the attacker's embedded command with the WAP's service account privileges (typically root/admin). Result: Attacker achieves RCE, can exfiltrate device configuration, modify firewall rules, pivot to connected clients, or establish persistence. If POC exists in public repositories (GitHub, exploit-db), risk increases substantially; automated scanning tools would trivially identify vulnerable versions. Timeline: Attack executes in seconds post-authentication; no user interaction required (UI:N).