CVE-2025-34058 affects Hangzhou Hikvision System Technology's Streaming Media Management Server version 2.3.5. The vulnerability arises from the use of default credentials that permit remote unauthenticated access. After successful authentication with these default credentials, an attacker can exploit a directory traversal vulnerability in the /systemLog/downFile.php endpoint by manipulating the fileName parameter to read arbitrary files on the server. This chain of vulnerabilities allows unauthorized disclosure of sensitive system files. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

The vulnerability allows remote attackers to authenticate using default credentials and subsequently read arbitrary files on the affected server via directory traversal. This can lead to unauthorized disclosure of sensitive system information, potentially compromising the confidentiality of the system. There is no indication of privilege escalation, integrity, or availability impact. No known exploits in the wild have been reported as of the publication date.

No official patch or fix is currently available for this vulnerability. Users should immediately change default credentials to strong, unique passwords to prevent unauthorized authentication. Restrict access to the /systemLog/downFile.php endpoint and validate input parameters to mitigate directory traversal risks. Monitor vendor advisories for updates or official patches addressing this issue.