CVE-2025-34058

🗓️ 01 Jul 2025 14:48:40Reported by VulnCheckType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 45 Views🌐 WEB

Hikvision Streaming Media Management Server allows exploitation due to default credentials and file read vulnerability

Reporter	Title	Published	Views	Family All 10
BDU FSTEC	The vulnerability of Hikvision Streaming Media Management Server, related to weak password requirements, allows attackers to gain access to confidential data.	24 Sep 202500:00	–	bdu_fstec
Circl	CVE-2025-34058	1 Jul 202515:08	–	circl
CNNVD	Hikvision Streaming Media Management Server 安全漏洞	1 Jul 202500:00	–	cnnvd
Cvelist	CVE-2025-34058 Hikvision Streaming Media Management Server Default Credentials and Authenticated Arbitrary File Read	1 Jul 202514:48	–	cvelist
EUVD	EUVD-2025-19639	3 Oct 202520:07	–	euvd
NVD	CVE-2025-34058	1 Jul 202515:15	–	nvd
Positive Technologies	PT-2025-27541 · Hikvision · Hikvision Streaming Media Management Server	1 Jul 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-34058	3 Jul 202515:23	–	redhatcve
VulnCheck KEV	VulnCheck KEV: CVE-2025-34058	1 Jul 202500:00	–	vulncheck_kev
Vulnrichment	CVE-2025-34058 Hikvision Streaming Media Management Server Default Credentials and Authenticated Arbitrary File Read	1 Jul 202514:48	–	vulnrichment

Vulners

CNA

Node

hangzhou_hikvision_system_technology streaming_media_management_serverMatch2.3.5

[
  {
    "defaultStatus": "unaffected",
    "modules": [
      "/login.php endpoint",
      "/systemLog/downFile.php endpoint",
      "fileName parameter"
    ],
    "product": "Streaming Media Management Server",
    "vendor": "Hangzhou Hikvision System Technology",
    "versions": [
      {
        "status": "affected",
        "version": "2.3.5"
      }
    ]
  }
]

Source	Link
cnvd	www.cnvd.org.cn/flaw/show/CNVD-2021-14544
hikvision	www.hikvision.com/en/support/cybersecurity/security-advisory/
blog	www.blog.csdn.net/qq_40684306/article/details/115278837
vulncheck	www.vulncheck.com/advisories/hikvision-streaming-server-default-creds-file-read

Parameter	Position	Path	Description	CWE
fileName	query param	systemLog/downFile.php	arbitrary file read via directory traversal in the fileName parameter	CWE-521, CWE-22

14 Jul 2026 22:25Current

6.7Medium risk

Vulners AI Score6.7

CVSS 48.7

EPSS0.00852

SSVC

hikvision streaming media default credentials arbitrary file read remote attackers directory traversal