CVE-2025-52601 is a high-severity hardcoded-cryptographic-key vulnerability (CWE-321) that Nozomi Networks Labs found baked into the firmware of a very large range of Hanwha Vision network cameras and multi-sensor cameras — NVD's structured data lists 128 distinct affected firmware identifiers spanning the XNO, XNV, XND, XNB, XNF, QNO, QNV, QND, PNM, TNV, KNO and KND model families — where a fixed symmetric encryption key is embedded in shipped firmware to protect sensitive stored information, so an attacker who extracts the key from any one device's firmware can decrypt the equivalent protected data, such as stored credentials, on every other affected device sharing that firmware line; NVD has published its own Primary CVSS v3.1 score of 7.8 (high).
Vulnerability summary
7.8
High
0.1%
EPSS score (FIRST)
No
CISA KEV catalog
2025-12-26
Published
Vulnerability ID: CVE-2025-52601 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Hanwha Vision network cameras and multi-sensor cameras across the XNO, XNV, XND, XNB, XNF, XNZ, XNP, QNO, QNV, QND, QNE, QNF, QNP, PNM, TNV, KNO and KND model families (NVD's CPE configuration data for this CVE lists 128 distinct vulnerable camera/firmware identifiers) | — | Firmware versions from 2.10.03 through 2.24.00, varying by model, all prior to Hanwha Vision's December 2025 patch; see Hanwha Vision's Camera Vulnerability Report for the exact fixed version per model |
What does this mean for affected devices?
CVE-2025-52601 (CWE-321, use of hard-coded cryptographic key) was discovered by Nozomi Networks Labs in Hanwha Vision camera firmware. NVD's description states: "Cybersecurity Nozomi Networks Labs, a specialized security company focused on Industrial Control Systems (ICS) and OT/IoT security, has discovered a vulnerability in Device Manager that a hardcoded encryption key for sensitive information. An attacker can use key to decrypt sensitive information. The manufacturer has released patch firmware for the flaw, please refer to the manufacturer's report for details and workarounds" (NVD).
NVD lists the CVE's status as "Analyzed" with its own Primary CVSS v3.1 base score of 7.8 (high), vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, alongside a lower Secondary CVSS v4.0 score of 6.3 submitted separately; NVD's CWE classification is CWE-321 (use of hard-coded cryptographic key) (NVD).
NVD's own CPE configuration data for this CVE lists 128 distinct vulnerable camera and firmware identifiers, spanning Hanwha Vision's XNO, XNV, XND, XNB, XNF, XNZ, XNP, QNO, QNV, QND, QNE, QNF, QNP, PNM, TNV, KNO and KND series bullet, box, dome, fisheye and multi-sensor camera lines, with affected firmware versions ranging from 2.10.03 up to 2.24.00 depending on the specific model — indicating the hardcoded-key design choice was shared broadly across Hanwha Vision's camera firmware rather than confined to a single product line (NVD).
Hanwha Vision's own S-CERT team published a combined vulnerability report covering CVE-2025-52598, CVE-2025-52600, CVE-2025-52601 and CVE-2025-8075 together, crediting Nozomi Networks Labs with reporting the issues on 2025-04-07 and stating the manufacturer has released patched firmware; the report is the vendor's authoritative source for the exact fixed firmware version per camera model (Hanwha Vision Camera Vulnerability Report, December 2025).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.00095 (0.609th percentile) as of 2026-11-07 — a high-severity firmware design flaw with a confirmed NVD score but no reported in-the-wild exploitation to date (CISA KEV, FIRST EPSS).
Exploiting a hardcoded key requires the attacker to first obtain it, typically by extracting and reverse-engineering a copy of the affected firmware — exactly the kind of binary-level analysis an SBOM/firmware-scanning workflow is built to catch before deployment. Operators running any of the affected Hanwha Vision camera or multi-sensor models should update to the firmware version specified in Hanwha Vision's December 2025 report and should not assume data encrypted with this key remains confidential once any single affected device's firmware has been extracted.
Evidence
- Nozomi Networks Labs discovered a vulnerability where a hardcoded encryption key for sensitive information lets an attacker decrypt that information; manufacturer released patch firmware. — NVD
- NVD status 'Analyzed'; NVD Primary CVSS v3.1 base score 7.8, vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; Secondary CVSS v4.0 score 6.3; CWE-321. — NVD
- NVD's CPE configuration data lists 128 distinct vulnerable camera/firmware identifiers across the XNO, XNV, XND, XNB, XNF, XNZ, XNP, QNO, QNV, QND, QNE, QNF, QNP, PNM, TNV, KNO and KND series, firmware 2.10.03 through 2.24.00. — NVD
- Hanwha Vision S-CERT's combined report covers CVE-2025-52598, 52600, 52601 and 8075 together, credits Nozomi Networks Labs with reporting on 2025-04-07, and states patched firmware has been released. — Hanwha Vision Camera Vulnerability Report, December 2025
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.00095 (0.609th percentile) as of 2026-11-07. — FIRST EPSS
Questions about this page?
Related advisories
Sources
Frequently asked questions
What does the hardcoded encryption key in CVE-2025-52601 actually expose?
Hanwha Vision camera firmware embeds a fixed symmetric encryption key used to protect sensitive stored information; an attacker who extracts that key from one device's firmware can decrypt the equivalent protected data — such as stored credentials or configuration values — on any other affected device running the same firmware line (per NVD).
How many Hanwha Vision camera models does CVE-2025-52601 affect?
NVD's structured CPE data lists 128 distinct vulnerable camera and firmware identifiers spanning Hanwha Vision's XNO, XNV, XND, XNB, XNF, XNZ, XNP, QNO, QNV, QND, QNE, QNF, QNP, PNM, TNV, KNO and KND series, with affected firmware versions from 2.10.03 through 2.24.00 depending on model (per NVD).
Who found CVE-2025-52601 and has Hanwha Vision fixed it?
Nozomi Networks Labs discovered the flaw and reported it to Hanwha Vision's S-CERT team on 2025-04-07; Hanwha Vision has released patched firmware and published a combined vulnerability report covering this and three related CVEs with per-model fix guidance (per Hanwha Vision's Camera Vulnerability Report).