CVE-2025-8075: Improper Input Validation

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-12-26 · updated 2026-10-07
Weakness: CWE-20

Description

Cybersecurity Nozomi Networks Labs, a specialized security company focused on Industrial Control Systems (ICS) and OT/IoT security, has discovered that validation of incoming XML format request messages is inadequate. This vulnerability could allow an attacker to XSS on the user's browser. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds.

Affected products

Hanwhavision Knb-2000 Firmware: before 2.23.01 — fixed in 2.23.01
Hanwhavision Knb-5000N Firmware: before 2.23.01 — fixed in 2.23.01
Hanwhavision Knd-2010 Firmware: before 2.23.01 — fixed in 2.23.01
Hanwhavision Knd-2020Rn Firmware: before 2.23.01 — fixed in 2.23.01
Hanwhavision Knd-2080Rn Firmware: before 2.23.01 — fixed in 2.23.01
Hanwhavision Knd-5020Rn Firmware: before 2.23.01 — fixed in 2.23.01
Hanwhavision Knd-5080Rn Firmware: before 2.23.01 — fixed in 2.23.01
Hanwhavision Kno-2010Rn Firmware: before 2.23.01 — fixed in 2.23.01
Hanwhavision Kno-2080Rn Firmware: before 2.23.01 — fixed in 2.23.01
Hanwhavision Kno-2120Rn Firmware: before 2.23.01 — fixed in 2.23.01
Hanwhavision Kno-5020Rn Firmware: before 2.23.01 — fixed in 2.23.01
Hanwhavision Kno-5080Rn Firmware: before 2.23.01 — fixed in 2.23.01
Hanwhavision Knp-2120Hn Firmware: before 2.23.01 — fixed in 2.23.01
Hanwhavision Knp-2320Rh Firmware: before 2.23.01 — fixed in 2.23.01
Hanwhavision Knp-2320Rha Firmware: before 2.23.01 — fixed in 2.23.01
Hanwhavision Knp-2550Rha Firmware: before 2.23.01 — fixed in 2.23.01
Hanwhavision Pnm-7000Vd Firmware: before 2.23.00 — fixed in 2.23.00
Hanwhavision Pnm-7002Vd Firmware: before 2.23.00 — fixed in 2.23.00
Hanwhavision Pnm-9000Vd Firmware: before 2.23.00 — fixed in 2.23.00
Hanwhavision Pnm-9000Vq Firmware: before 2.23.00 — fixed in 2.23.00
Hanwhavision Pnm-9002Vq Firmware: before 2.23.00 — fixed in 2.23.00
Hanwhavision Pnm-9080Vq Firmware: before 2.23.00 — fixed in 2.23.00
Hanwhavision Pnm-9081Vq Firmware: before 2.23.00 — fixed in 2.23.00
Hanwhavision Pnm-9084Qz1 Firmware: before 2.23.00 — fixed in 2.23.00
Hanwhavision Pnm-9084Qz Firmware: before 2.23.00 — fixed in 2.23.00
Hanwhavision Pnm-9084Rqz1 Firmware: before 2.23.00 — fixed in 2.23.00
Hanwhavision Pnm-9084Rqz Firmware: before 2.23.00 — fixed in 2.23.00
Hanwhavision Pnm-9085Rqz1 Firmware: before 2.23.00 — fixed in 2.23.00
Hanwhavision Pnm-9085Rqz Firmware: before 2.23.00 — fixed in 2.23.00
Hanwhavision Pnm-9320Vqp Firmware: before 2.23.00 — fixed in 2.23.00

How to fix

Upgrade to a fixed version: Hanwhavision Knb-2000 Firmware 2.23.01; Hanwhavision Knb-5000N Firmware 2.23.01; Hanwhavision Knd-2010 Firmware 2.23.01; Hanwhavision Knd-2020Rn Firmware 2.23.01; Hanwhavision Knd-2080Rn Firmware 2.23.01; Hanwhavision Knd-5020Rn Firmware 2.23.01; Hanwhavision Knd-5080Rn Firmware 2.23.01; Hanwhavision Kno-2010Rn Firmware 2.23.01; Hanwhavision Kno-2080Rn Firmware 2.23.01; Hanwhavision Kno-2120Rn Firmware 2.23.01; Hanwhavision Kno-5020Rn Firmware 2.23.01; Hanwhavision Kno-5080Rn Firmware 2.23.01. Check the vendor advisory for mitigations.

References

https://www.hanwhavision.com/wp-content/uploads/2025/12/Camera-Vulnerability-ReportCVE-2025-5259852601-8075.pdf

Get alerted when CVE-2025-8075 or the next vulnerability affects your stack