CVE-2017-7921

critical

Description

An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.

References

https://www.hikvision.com/us-en/support/document-center/special-notices/privilege-escalating-vulnerability-in-certain-hikvision-ip-cameras/

https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification--privilege-escalating-vulnerability-in-cer/

https://www.hikvision.com/cn/support/CybersecurityCenter/SecurityNotices/20170314/

https://ics-cert.us-cert.gov/advisories/ICSA-17-124-01

https://securityaffairs.com/189069/cyber-warfare-2/iran-linked-hackers-target-ip-cameras-across-israel-and-gulf-states-for-military-intelligence.html

https://thehackernews.com/2026/03/iran-linked-muddywater-hackers-target.html

https://thehackernews.com/2026/03/hikvision-and-rockwell-automation-cvss.html

https://securityaffairs.com/189005/security/u-s-cisa-adds-apple-rockwell-and-hikvision-flaws-to-its-known-exploited-vulnerabilities-catalog.html

https://www.cisa.gov/news-events/alerts/2026/03/05/cisa-adds-five-known-exploited-vulnerabilities-catalog

https://www.theregister.com/2026/03/04/iranian_hacking_attempts_ip_cameras/

https://www.infosecurity-magazine.com/news/iran-attacks-surveillance-cameras/

https://research.checkpoint.com/2026/interplay-between-iranian-targeting-of-ip-cameras-and-physical-warfare-in-the-middle-east/

https://isc.sans.edu/diary/rss/32316

https://www.infosecurity-magazine.com/news/webcams-vulnerable-hiatusrat-fbi/

https://thehackernews.com/2024/12/cisa-and-fbi-raise-alerts-on-exploited.html

https://www.bleepingcomputer.com/news/security/fbi-spots-hiatusrat-malware-attacks-targeting-web-cameras-dvrs/

https://www.tenable.com/blog/cyber-retaliation-analyzing-iranian-cyber-activity-following-operation-epic-fury

https://github.com/xjghnxhlh/hikihack

https://github.com/Exhunterx/eyesharvester

https://github.com/mrhenrike/EmbedXPL-Forge

https://github.com/KelvinWin10/CVE-2017-7921-rewrite

https://github.com/mverschu/CVE-2017-7921

https://github.com/Wyl-cmd/CVE-2017-7921-Research-Toolkit

https://github.com/saaydmr/hikvision-exploiter

https://github.com/f3d0rq/CVE-2017-7921

https://github.com/voidsshadows/Hikvision-City-Hunter

https://github.com/lastvocher/Hikvision-CVE-2017-7921-decryptor

https://github.com/andychao/CVE-2017-7921_reproduces_decrypted_file_sharing

https://github.com/aengussong/hikvision_probe

https://github.com/kooroshsanaei/HikVision-CVE-2017-7921

https://github.com/krypton612/hikivision

https://github.com/201646613/CVE-2017-7921

https://github.com/chrisjd20/hikvision_CVE-2017-7921_auth_bypass_config_decryptor

https://github.com/JrDw0/CVE-2017-7921-EXP

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-7921

https://ghostbin.com/paste/q2vq2

http://www.securityfocus.com/bid/98313

http://www.hikvision.com/us/about_10805.html

Details

Source: Mitre, NVD

Published: 2017-05-06

Updated: 2026-06-17

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Severity: High

CVSS v3

Base Score: 9.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: Critical

EPSS

EPSS: 0.99998