CVE-2017-7921
Hikvision Multiple Products Improper Authentication Vulnerability
Description
CVE-2017-7921 is a CRITICAL severity improper authentication vulnerability (CWE-287) in multiple Hikvision IP camera and network video recorder product lines, including the DS-2CD2xx2F-I, DS-2CD2xx0F-I, DS-2CD2xx2FWD, DS-2CD4x2xFWD, DS-2CD4xx5, DS-2DFx, and DS-2CD63xx series. The vulnerability allows a malicious user to bypass authentication mechanisms and escalate privileges, gaining access to sensitive device information including configuration data. With a CVSS 3.1 score of 9.8 and a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, the flaw is remotely exploitable with no authentication or user interaction required. Various firmware versions from V5.2.0 through V5.4.x builds are affected. CISA added CVE-2017-7921 to the Known Exploited Vulnerabilities catalog on March 5, 2026, with a remediation deadline of March 26, 2026. The EPSS score of 0.943 (94.3rd percentile) reflects an extremely high probability of active exploitation, consistent with the widespread deployment of Hikvision cameras in enterprise and critical infrastructure environments.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| hikvision | ds-2cd2032-i firmware | - |
| hikvision | ds-2cd2112-i firmware | - |
| hikvision | ds-2cd2132-i firmware | - |
| hikvision | ds-2cd2212-i5 firmware | - |
| hikvision | ds-2cd2232-i5 firmware | - |
| hikvision | ds-2cd2312-i firmware | - |
| hikvision | ds-2cd2332-i firmware | - |
| hikvision | ds-2cd2412f-i\(w\) firmware | - |
| hikvision | ds-2cd2432f-i\(w\) firmware | - |
| hikvision | ds-2cd2512f-i\(s\) firmware | - |
| hikvision | ds-2cd2532f-i\(s\) firmware | - |
| hikvision | ds-2cd2612f-i\(s\) firmware | - |
| hikvision | ds-2cd2632f-i\(s\) firmware | - |
| hikvision | ds-2cd2712f-i\(s\) firmware | - |
| hikvision | ds-2cd2732f-i\(s\) firmware | - |
| hikvision | ds-2cd2t32-i3 firmware | - |
| hikvision | ds-2cd2t32-i5 firmware | - |
| hikvision | ds-2cd2t32-i8 firmware | - |
| hikvision | ds-2cd4012f-\(a\) firmware | - |
| hikvision | ds-2cd4012f-\(p\) firmware | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://www.hikvision.com/us/about_10805.html(Patch, Vendor Advisory)
- http://www.securityfocus.com/bid/98313(Broken Link, Third Party Advisory, VDB Entry)
- https://ghostbin.com/paste/q2vq2(Broken Link)
- https://ics-cert.us-cert.gov/advisories/ICSA-17-124-01(Third Party Advisory, US Government Resource)
- https://www.hikvision.com/cn/support/CybersecurityCenter/SecurityNotices/20170314/(Third Party Advisory)
- https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification--privilege-escalating-vulnerability-in-cer/(Third Party Advisory)
- https://www.hikvision.com/us-en/support/document-center/special-notices/privilege-escalating-vulnerability-in-certain-hikvision-ip-cameras/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-7921(US Government Resource)
Weakness Type
CWE-287: Improper Authentication
Improper Authentication (CWE-287) is a vulnerability class where a system fails to properly verify that a user, process, or entity is who it claims to be. This weakness occurs when authentication mechanisms can be bypassed, contain logic flaws, or are missing entirely. Attackers exploiting improper authentication can gain unauthorized access to systems, data, or administrative functions without providing valid credentials.
In CVE-2017-7921, affected Hikvision camera firmware contains a flaw in its authentication handling that allows an attacker to craft specific requests to the device's web interface or API that bypass the normal credential verification process. By exploiting this weakness, an unauthenticated remote attacker can escalate privileges to administrative level, gaining full control over the device. This includes the ability to view live camera feeds, modify device configuration, extract stored credentials, and potentially use the compromised device as a pivot point for further network intrusion. The vulnerability is particularly dangerous because Hikvision cameras are often deployed on networks with access to sensitive physical areas, and many deployments retain default configurations with minimal network segmentation.
Impact Analysis
CVE-2017-7921 carries a CVSS 3.1 base score of 9.8 (CRITICAL), reflecting severe impact across all three security dimensions.
Confidentiality (High): An attacker exploiting this vulnerability gains unauthorized access to all data stored on and transmitted through the affected device. This includes live video feeds, recorded footage, device configuration files, stored user credentials, and network configuration details. For surveillance systems deployed in sensitive environments such as government facilities, financial institutions, or critical infrastructure, the exposure of video feeds alone represents a severe confidentiality breach.
Integrity (High): With administrative access obtained through the authentication bypass, an attacker can modify device configuration, alter recording schedules, disable motion detection, change network settings, and update firmware. The ability to manipulate surveillance camera settings undermines the integrity of the entire physical security system, as attackers can create blind spots or tamper with evidence.
Availability (High): An attacker with escalated privileges can disable the camera entirely, trigger factory resets, or modify configuration to render the device inoperable. In deployments where Hikvision cameras serve as part of critical security monitoring infrastructure, loss of availability can have cascading effects on physical security posture.
Scope (Unchanged): While the direct impact is contained to the vulnerable Hikvision device, compromised cameras frequently serve as entry points for lateral movement within networks. The EPSS score of 0.943 places this vulnerability in the top tier for exploitation probability, reflecting both the prevalence of vulnerable devices and the active interest of threat actors in IoT and surveillance device exploitation.
Exploit Maturity
Active Exploitation: CVE-2017-7921 is confirmed as actively exploited in the wild. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on March 5, 2026, with a federal remediation deadline of March 26, 2026. The vulnerability has been widely targeted by botnets and advanced threat actors since its disclosure in 2017, particularly due to the large number of internet-exposed Hikvision devices.
Ransomware Association: Compromised Hikvision cameras have been observed as initial access vectors in campaigns that ultimately deploy ransomware on connected enterprise networks. The authentication bypass provides attackers with a foothold on the network that can be leveraged for lateral movement and privilege escalation within the broader environment.
Public Exploits: Multiple public proof-of-concept exploits and exploitation tools are available for CVE-2017-7921. Exploit code has been integrated into popular penetration testing frameworks and IoT scanning tools. The simplicity of exploitation (a single crafted HTTP request) has made this vulnerability a common target for automated scanning campaigns.
EPSS Context: The EPSS score of 0.943 (94.3rd percentile) places this vulnerability among the most likely to be exploited of all known CVEs. This extreme score reflects the combination of trivial exploitation complexity, widespread device deployment, and frequent internet exposure of affected cameras.
KEV Deadline: The CISA remediation deadline is March 26, 2026. Organizations operating affected Hikvision products must apply firmware updates or implement compensating controls immediately.
Remediation
-
Apply the latest Hikvision firmware update. Hikvision released patched firmware versions that address the authentication bypass. Update all affected camera models (DS-2CD2xx2F-I, DS-2CD2xx0F-I, DS-2CD2xx2FWD, DS-2CD4x2xFWD, DS-2CD4xx5, DS-2DFx, DS-2CD63xx series) to the latest available firmware through the Hikvision support portal. Verify that firmware versions V5.2.0 through V5.4.x builds are no longer in use.
-
Isolate cameras on a dedicated network segment. Place all IP cameras and video surveillance equipment on a separate VLAN with strict firewall rules that restrict communication to only the video management system (VMS) and authorized management workstations. Block all direct internet access from camera network segments.
-
Remove devices from direct internet exposure. Audit all network configurations to ensure that no affected Hikvision devices are directly accessible from the internet. Use VPN connections for remote access to surveillance systems rather than port forwarding or DMZ placement.
-
Change all default credentials. Even after patching, ensure that all device passwords have been changed from factory defaults to strong, unique credentials. Implement a credential management policy for IoT and surveillance devices.
-
Enable HTTPS and disable unnecessary services. Configure cameras to use HTTPS for all web interface and API communications. Disable ONVIF, Telnet, SSH, and other services that are not required for operation to reduce the attack surface.
-
Implement network monitoring for compromised devices. Deploy network monitoring to detect anomalous traffic from camera network segments, including unexpected outbound connections, port scanning activity, or communication with known malicious infrastructure. Devices that were exposed prior to patching should be treated as potentially compromised and forensically examined.
Technical Details
CVE-2017-7921 is an improper authentication vulnerability in the web server component of multiple Hikvision IP camera and NVR product lines. The affected firmware versions (V5.2.0 through V5.4.x builds) contain a flaw in the request handling logic that allows specially crafted HTTP requests to bypass the authentication verification process entirely.
The vulnerability exists because certain API endpoints on the device's embedded web server do not properly enforce authentication checks before processing requests. An attacker can send a crafted request to these endpoints that the server processes as if it came from an authenticated administrative user. This grants the attacker access to privileged operations including configuration retrieval, credential extraction, firmware management, and live video stream access.
The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects that exploitation is entirely network-based, requires no authentication or user interaction, and has low attack complexity. The attack can be carried out with a single HTTP request, making it trivially automatable. The high impact across confidentiality, integrity, and availability stems from the complete administrative access that the authentication bypass provides.
Affected product lines span Hikvision's range of IP cameras designed for enterprise and commercial deployment. The breadth of affected models and firmware versions means that a large installed base of devices is vulnerable. Many of these devices are deployed in environments where firmware updates are infrequent or where device management is decentralized, contributing to the persistence of this vulnerability years after patches were made available.
Frequently Asked Questions
What is CVE-2017-7921?
CVE-2017-7921 is a critical improper authentication vulnerability in multiple Hikvision IP camera product lines. The flaw allows an unauthenticated remote attacker to bypass authentication and gain administrative access to the device, including the ability to view live video feeds, extract credentials, and modify device configuration. It affects firmware versions V5.2.0 through V5.4.x across multiple DS-2CD and DS-2DF series cameras.
Which Hikvision products are affected?
The vulnerability affects the DS-2CD2xx2F-I Series, DS-2CD2xx0F-I Series, DS-2CD2xx2FWD Series, DS-2CD4x2xFWD Series, DS-2CD4xx5 Series, DS-2DFx Series, and DS-2CD63xx Series with firmware versions V5.2.0 through V5.4.x builds. Check Hikvision's security advisory for the complete list of affected model numbers and firmware versions.
How do I fix CVE-2017-7921?
Update the firmware on all affected Hikvision cameras to the latest version available from the Hikvision support portal. Additionally, isolate cameras on a dedicated network segment, remove any direct internet exposure, change all default passwords, and enable HTTPS on all devices. Devices that were internet-exposed before patching should be treated as potentially compromised.
Why is CVE-2017-7921 so dangerous?
Three factors make this vulnerability exceptionally dangerous: its trivial exploitability (a single crafted HTTP request), the massive number of deployed Hikvision cameras worldwide, and the frequent internet exposure of these devices. The EPSS score of 0.943 (94.3rd percentile) and its inclusion in CISA's KEV catalog confirm active, widespread exploitation. Compromised cameras can serve as network entry points for more extensive attacks including ransomware deployment.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.