CISA KEV alertCyberSIXT
Hikvision CVE-2017-7921 Improper authentication enables access
Part of the CVE-2017-7921 story · since 4 Mar
- Wed 4 Mar, 03:57 UTC. Check Point, first report. Iranian actors exploit Hikvision and Dahua IP cameras via CVEs. Cites a CVE in CISA KEV.
- Wed 4 Mar, 15:08 UTC. Infosecurity, its first report on the story. Iran-linked Hackers Target Hikvision Cameras via CVE-2021-33044. Cites a CVE in CISA KEV.
- Thu 5 Mar, 21:21 UTC. CISA, its first report on the story. Hikvision CVE-2017-7921 Improper authentication enables access. Cites a CVE in CISA KEV. This article, 3rd of 10.
- Thu 5 Mar, 21:44 UTC. CISA. KEV Adds Hikvision CVE-2017-7921 Privilege Escalation Risk. Cites a CVE in CISA KEV.
- Fri 6 Mar, 08:24 UTC. The Hacker News, its first report on the story. CISA flags CVE-2017-7921 CVE-2021-22681 amid Hikvision exploits. Cites a CVE in CISA KEV.
- Fri 6 Mar, 09:57 UTC. Security Affairs, its first report on the story. CISA Adds CVEs to KEV for Apple Rockwell and Hikvision Flaws. Cites a CVE in CISA KEV.
- Fri 6 Mar, 10:59 UTC. SOCRadar, its first report on the story. KEV adds CVE-2017-7921 and CVE-2021-22681 patch due by 26 Mar. Cites a CVE in CISA KEV.
- Fri 6 Mar, 14:34 UTC. Dark Reading, its first report on the story. Iran weaponises cameras with CVEs to plan missile strikes. Cites a CVE in CISA KEV.
- Sat 7 Mar, 10:55 UTC. Security Affairs. Iran-linked actors scan Hikvision and Dahua cams via VPN for CVEs. Cites a CVE in CISA KEV.
- Tue 27 Oct, 07:30 UTC. The Hacker News. CERT-UA reports attacks on Dahua cameras in Ukraine. Cites a CVE in CISA KEV.
CISA has added CVE-2017-7921 to its Known Exploited Vulnerabilities (KEV) catalogue, affecting Hikvision and multiple Hikvision products. The vulnerability is titled Hikvision Multiple Products Improper Authentication Vulnerability and could allow a malicious user to escalate privileges on the system and access sensitive information. The entry was added on 2026-03-05.
Technical detail: This is an improper authentication vulnerability with privilege escalation potential across multiple Hikvision products. The CVSS score is 9.8 (CRITICAL), underscoring the high impact of successful exploitation. A patch is available from Hikvision, and mitigations are documented in the vendor advisories and the associated NVD page (CVE-2017-7921). Patch status: available.
Exploitation and risk: Active exploitation has been confirmed, which is the premise of KEV entries. Ransomware campaign use is unknown for this CVE. The remediation deadline is 2026-03-26, after which CISA expects organisations to have mitigated or remediated exposed systems.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Directly affected: FCEB agencies. All organisations should review their exposure and apply the approved mitigations where applicable.
For full details, see the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2017-7921 and the CISA KEV catalogue at https://www.cisa.gov/known-exploited-vulnerabilities-catalog.
How the story developed
10 articles from 7 outlets since 4 Mar. Picked up again today after 33 weeks quiet. This was the 3rd report, 2 days after the first.
- Wed 4 Mar, 03:57 UTC. Check Point, first report. Iranian actors exploit Hikvision and Dahua IP cameras via CVEs. Cites a CVE in CISA KEV.
- Wed 4 Mar, 15:08 UTC. Infosecurity, its first report on the story. Iran-linked Hackers Target Hikvision Cameras via CVE-2021-33044. Cites a CVE in CISA KEV.
- Thu 5 Mar, 21:21 UTC. CISA, its first report on the story. Hikvision CVE-2017-7921 Improper authentication enables access. Cites a CVE in CISA KEV. This article, 3rd of 10.
- Thu 5 Mar, 21:44 UTC. CISA. KEV Adds Hikvision CVE-2017-7921 Privilege Escalation Risk. Cites a CVE in CISA KEV.
- Fri 6 Mar, 08:24 UTC. The Hacker News, its first report on the story. CISA flags CVE-2017-7921 CVE-2021-22681 amid Hikvision exploits. Cites a CVE in CISA KEV.
- Fri 6 Mar, 09:57 UTC. Security Affairs, its first report on the story. CISA Adds CVEs to KEV for Apple Rockwell and Hikvision Flaws. Cites a CVE in CISA KEV.
- Fri 6 Mar, 10:59 UTC. SOCRadar, its first report on the story. KEV adds CVE-2017-7921 and CVE-2021-22681 patch due by 26 Mar. Cites a CVE in CISA KEV.
- Fri 6 Mar, 14:34 UTC. Dark Reading, its first report on the story. Iran weaponises cameras with CVEs to plan missile strikes. Cites a CVE in CISA KEV.
- Sat 7 Mar, 10:55 UTC. Security Affairs. Iran-linked actors scan Hikvision and Dahua cams via VPN for CVEs. Cites a CVE in CISA KEV.
- Tue 27 Oct, 07:30 UTC. The Hacker News. CERT-UA reports attacks on Dahua cameras in Ukraine. Cites a CVE in CISA KEV.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Square: official source
- Coverage over time
- Quiet time, folded
Show all 10 articles as a listHide the list
- Wed 4 MarDay 02
- Iranian actors exploit Hikvision and Dahua IP cameras via CVEs03:57 · Check Point · First report · Exploited CVE · Known exploited CVE
- Iran-linked Hackers Target Hikvision Cameras via CVE-2021-3304415:08 · Infosecurity · Known exploited CVE
- Thu 5 MarDay 12
- Hikvision CVE-2017-7921 Improper authentication enables access21:21 · CISA · official · CISA alert · Known exploited CVE · This article, 3rd of 10
- KEV Adds Hikvision CVE-2017-7921 Privilege Escalation Risk21:44 · CISA · official · Known exploited CVE
- Fri 6 MarDay 24
- CISA flags CVE-2017-7921 CVE-2021-22681 amid Hikvision exploits08:24 · The Hacker News · Known exploited CVE
- CISA Adds CVEs to KEV for Apple Rockwell and Hikvision Flaws09:57 · Security Affairs · Known exploited CVE
- Sat 7 MarDay 31
- Iran-linked actors scan Hikvision and Dahua cams via VPN for CVEs10:55 · Security Affairs · Known exploited CVE
Quiet for 33 weeks
Tue 27 OctDay 2371- CERT-UA reports attacks on Dahua cameras in Ukraine07:30 · The Hacker News · Picked up again · Known exploited CVE