Full Report
Cisco Talos’ Vulnerability Discovery & Research team recently disclosed a vulnerability in HikVision, as well as 10 in TP-Link, and 19 in Canva.The vulnerabilities mentioned in this blog post have been patched by their respective vendors, all in adherence to Cisco’s third-party vulnerability disclosure policy.For
Analysis Summary
This summary covers the vulnerability disclosures for Canva Affinity, TP-Link, and HikVision as of March 2026.
---
# Vulnerability: Multiple Flaws in Canva Affinity, TP-Link Archer, and HikVision Terminals
## CVE Details
- **CVE IDs:**
- **Canva (19):** CVE-2025-66342 (Type Confusion), CVE-2025-64776, CVE-2025-64301, and 16 others (OOB Read).
- **TP-Link (10):** CVE-2025-62673, CVE-2025-59482, CVE-2025-62405, CVE-2025-59487, CVE-2025-61983, CVE-2025-62404, CVE-2025-61944, CVE-2025-58455, CVE-2025-58077, CVE-2025-62501.
- **HikVision (1):** CVE-2025-66176.
- **CVSS Score:** Not explicitly listed in source; however, buffer overflows and arbitrary code execution typically range from **8.8 to 9.8 (Critical)**.
- **CWE:** CWE-121 (Stack-based Buffer Overflow), CWE-125 (Out-of-bounds Read), CWE-787 (Out-of-bounds Write), CWE-843 (Type Confusion), CWE-122 (Heap-based Buffer Overflow).
## Affected Systems
- **Products:**
- Canva Affinity (Graphic design software)
- TP-Link Archer AX53 (Dual-band Gigabit Wi-Fi Router)
- HikVision Ultra Face Recognition Terminal / Face Recognition Terminal for Turnstyle
- **Versions:**
- **TP-Link:** Archer AX53 (Specific firmware versions not listed, implied current at time of discovery).
- **HikVision:** Ultra Face Recognition Terminal 3.7.60_250613; Face Recognition Terminal for Turnstyle 3.7.0_240524.
- **Configurations:**
- **Canva:** Systems processing maliciously crafted EMF (Enhanced Metafile) files.
- **TP-Link:** Routers with `tdpServer` and `tmpServer` services exposed.
- **HikVision:** Terminals utilizing SADP XML parsing functionality.
## Vulnerability Description
- **Canva Affinity:** 18 flaws are Out-of-Bounds (OOB) reads in the EMF file processing engine, leading to information disclosure. One flaw (CVE-2025-66342) is a **Type Confusion** error that allows for memory corruption and arbitrary code execution (RCE).
- **TP-Link:** Multiple memory corruption flaws (Stack/Heap overflows and OOB writes) within the `tdpServer` and `tmpServer` opcodes. These are triggered via specially crafted network packets. Additionally, a misconfiguration in SSH Hostkey functionality allows for credential theft via Man-in-the-Middle (MitM).
- **HikVision:** A stack-based buffer overflow exists in the **SADP XML parsing** functionality. By sending a malicious XML-based network packet, an attacker can overwrite memory to gain RCE.
## Exploitation
- **Status:** Patched. No reports of active exploitation in the wild at the time of disclosure.
- **Complexity:** Low to Medium.
- **Attack Vector:**
- **Canva:** Local/User Interaction (Opening a malicious file).
- **TP-Link/HikVision:** Network (Remote exploitation via crafted packets).
## Impact
- **Confidentiality:** High (Credential leaks in TP-Link; OOB reads in Canva).
- **Integrity:** High (Arbitrary code execution on all platforms).
- **Availability:** High (System crashes or full takeover).
## Remediation
### Patches
- Vendors have released updates for all listed vulnerabilities.
- **TP-Link:** Update Archer AX53 to the latest firmware via the TP-Link admin panel.
- **Canva:** Update Affinity to the latest version.
- **HikVision:** Apply firmware updates for Face Recognition Terminals.
### Workarounds
- **Network Segmentation:** Place IoT devices like TP-Link routers and HikVision terminals on isolated VLANs to prevent lateral movement.
- **Access Control:** Restrict access to the `tdpServer` (UDP/20002) and SSH ports on router hardware.
## Detection
- **Snort Rules:** Cisco Talos has released Snort rule sets to detect exploitation attempts for these specific CVEs.
- **IOCs:** Monitor for unusual XML traffic aimed at HikVision devices or unexpected `tdpServer` traffic on TP-Link devices.
## References
- Cisco Talos Blog: hxxps[://]blog[.]talosintelligence[.]com/tp-link-canva-hikvision-vulnerabilities/
- Talos Vulnerability Reports: hxxps[://]talosintelligence[.]com/vulnerability_reports
- Snort Rules: hxxps[://]snort[.]org/