Skip to content
OriginalSign in

CISA

KEV Adds Hikvision CVE-2017-7921 Privilege Escalation Risk

Part of the CVE-2017-7921 story · since 4 Mar

Developinglatest 2 hours ago10 articles7 outlets
4 Mar · Check Point first30 Jun9 Aug18 SepNowThis article4th of 10
  • Wed 4 Mar, 03:57 UTC. Check Point, first report. Iranian actors exploit Hikvision and Dahua IP cameras via CVEs. Cites a CVE in CISA KEV.
  • Wed 4 Mar, 15:08 UTC. Infosecurity, its first report on the story. Iran-linked Hackers Target Hikvision Cameras via CVE-2021-33044. Cites a CVE in CISA KEV.
  • Thu 5 Mar, 21:21 UTC. CISA, its first report on the story. Hikvision CVE-2017-7921 Improper authentication enables access. Cites a CVE in CISA KEV.
  • Thu 5 Mar, 21:44 UTC. CISA. KEV Adds Hikvision CVE-2017-7921 Privilege Escalation Risk. Cites a CVE in CISA KEV. This article, 4th of 10.
  • Fri 6 Mar, 08:24 UTC. The Hacker News, its first report on the story. CISA flags CVE-2017-7921 CVE-2021-22681 amid Hikvision exploits. Cites a CVE in CISA KEV.
  • Fri 6 Mar, 09:57 UTC. Security Affairs, its first report on the story. CISA Adds CVEs to KEV for Apple Rockwell and Hikvision Flaws. Cites a CVE in CISA KEV.
  • Fri 6 Mar, 10:59 UTC. SOCRadar, its first report on the story. KEV adds CVE-2017-7921 and CVE-2021-22681 patch due by 26 Mar. Cites a CVE in CISA KEV.
  • Fri 6 Mar, 14:34 UTC. Dark Reading, its first report on the story. Iran weaponises cameras with CVEs to plan missile strikes. Cites a CVE in CISA KEV.
  • Sat 7 Mar, 10:55 UTC. Security Affairs. Iran-linked actors scan Hikvision and Dahua cams via VPN for CVEs. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 07:30 UTC. The Hacker News. CERT-UA reports attacks on Dahua cameras in Ukraine. Cites a CVE in CISA KEV.

The Known Exploited Vulnerabilities (KEV) catalog lists CVE-2017-7921 as a Hikvision vulnerability affecting multiple products described as an Improper Authentication vulnerability that could allow a malicious user to escalate privileges on the system and gain access to sensitive information. The entry notes aRelated CWE: CWE-287 and states that it is Unknown whether it is Known To Be Used in Ransomware Campaigns. Date Added is 5 March 2026 with a Due Date of 26 March 2026.

The recommended action is to apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. This item appears under the Hikvision vendor/project listing in the KEV catalog, which serves as an input to vulnerability management prioritization for defenders. Additional notes include links to Hikvision support notices and the NVD entry for CVE-2017-7921.

How the story developed

All 10 articles
Developinglatest 2 hours ago10 articles7 outlets

10 articles from 7 outlets since 4 Mar. Picked up again today after 33 weeks quiet. This was the 4th report, 2 days after the first.

Now4 Mar4567891025 OctFirst reportCheck Point · 4 Mar, 03:57This article4th of 10 · day 1
  • Wed 4 Mar, 03:57 UTC. Check Point, first report. Iranian actors exploit Hikvision and Dahua IP cameras via CVEs. Cites a CVE in CISA KEV.
  • Wed 4 Mar, 15:08 UTC. Infosecurity, its first report on the story. Iran-linked Hackers Target Hikvision Cameras via CVE-2021-33044. Cites a CVE in CISA KEV.
  • Thu 5 Mar, 21:21 UTC. CISA, its first report on the story. Hikvision CVE-2017-7921 Improper authentication enables access. Cites a CVE in CISA KEV.
  • Thu 5 Mar, 21:44 UTC. CISA. KEV Adds Hikvision CVE-2017-7921 Privilege Escalation Risk. Cites a CVE in CISA KEV. This article, 4th of 10.
  • Fri 6 Mar, 08:24 UTC. The Hacker News, its first report on the story. CISA flags CVE-2017-7921 CVE-2021-22681 amid Hikvision exploits. Cites a CVE in CISA KEV.
  • Fri 6 Mar, 09:57 UTC. Security Affairs, its first report on the story. CISA Adds CVEs to KEV for Apple Rockwell and Hikvision Flaws. Cites a CVE in CISA KEV.
  • Fri 6 Mar, 10:59 UTC. SOCRadar, its first report on the story. KEV adds CVE-2017-7921 and CVE-2021-22681 patch due by 26 Mar. Cites a CVE in CISA KEV.
  • Fri 6 Mar, 14:34 UTC. Dark Reading, its first report on the story. Iran weaponises cameras with CVEs to plan missile strikes. Cites a CVE in CISA KEV.
  • Sat 7 Mar, 10:55 UTC. Security Affairs. Iran-linked actors scan Hikvision and Dahua cams via VPN for CVEs. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 07:30 UTC. The Hacker News. CERT-UA reports attacks on Dahua cameras in Ukraine. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 10 articles as a list
  1. Wed 4 MarDay 02
    1. Iranian actors exploit Hikvision and Dahua IP cameras via CVEs03:57 · Check Point · First report · Exploited CVE · Known exploited CVE
    2. Iran-linked Hackers Target Hikvision Cameras via CVE-2021-3304415:08 · Infosecurity · Known exploited CVE
  2. Thu 5 MarDay 12
    1. Hikvision CVE-2017-7921 Improper authentication enables access21:21 · CISA · official · CISA alert · Known exploited CVE
    2. KEV Adds Hikvision CVE-2017-7921 Privilege Escalation Risk21:44 · CISA · official · Known exploited CVE · This article, 4th of 10
  3. Fri 6 MarDay 24
    1. CISA flags CVE-2017-7921 CVE-2021-22681 amid Hikvision exploits08:24 · The Hacker News · Known exploited CVE
    2. CISA Adds CVEs to KEV for Apple Rockwell and Hikvision Flaws09:57 · Security Affairs · Known exploited CVE
    3. KEV adds CVE-2017-7921 and CVE-2021-22681 patch due by 26 Mar10:59 · SOCRadar · Known exploited CVE
    4. Iran weaponises cameras with CVEs to plan missile strikes14:34 · Dark Reading · Known exploited CVE
  4. Sat 7 MarDay 31
    1. Iran-linked actors scan Hikvision and Dahua cams via VPN for CVEs10:55 · Security Affairs · Known exploited CVE

  5. Quiet for 33 weeks

    Tue 27 OctDay 2371
    1. CERT-UA reports attacks on Dahua cameras in Ukraine07:30 · The Hacker News · Picked up again · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in