This vulnerability (CVE-2025-34067) affects the Hikvision Integrated Security Management Platform due to the use of a vulnerable Fastjson library version in the applyCT component. The endpoint /bic/ssoService/v1/applyCT deserializes untrusted input without sufficient validation, enabling attackers to trigger Fastjson's auto-type feature. By referencing a malicious Java class via an LDAP URL, an attacker can execute arbitrary code remotely without authentication. The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data). The CVSS 4.0 base score is 10.0, indicating critical severity. Exploitation evidence was reported by Shadowserver Foundation on 2025-02-05 UTC. No official patch or remediation details have been provided by the vendor as of the publication date.

Successful exploitation results in unauthenticated remote code execution on the underlying system hosting the Hikvision Integrated Security Management Platform. This allows attackers full control over the affected system, potentially leading to system compromise, data theft, or further network penetration.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoint and monitor for suspicious activity related to Fastjson deserialization. Avoid exposing the vulnerable service to untrusted networks. Follow vendor communications closely for updates on patches or mitigations.