Skip to content
Sign in
CVE-2017-7921Not scoredCWE-287

Hikvision Multiple Products Improper Authentication Vulnerability

Hikvision · Multiple Products

Exploited in the wild · in CISA KEV since 5 Mar
99.9%probability of exploitation in the next 30 days
99th percentile
050100

Higher than 99% of scored CVEs

Not scored yet. NVD has not published a CVSS score.

Federal deadline

CISA KEV · added 5 Mar · catalogue entry

Passed 214 days ago

DescriptionNVD

An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Coverage10 articles · 7 outlets

First in our coverage: Check Point, 4 Mar.

Full timeline
Developinglatest 58 minutes ago10 articles7 outlets
4 Mar · Check Point first30 Jun9 Aug18 SepNow
  • Wed 4 Mar, 03:57 UTC. Check Point, first report. Iranian actors exploit Hikvision and Dahua IP cameras via CVEs. Cites a CVE in CISA KEV.
  • Wed 4 Mar, 15:08 UTC. Infosecurity, its first report on the story. Iran-linked Hackers Target Hikvision Cameras via CVE-2021-33044. Cites a CVE in CISA KEV.
  • Thu 5 Mar, 21:21 UTC. CISA, its first report on the story. Hikvision CVE-2017-7921 Improper authentication enables access. Cites a CVE in CISA KEV.
  • Thu 5 Mar, 21:44 UTC. CISA. KEV Adds Hikvision CVE-2017-7921 Privilege Escalation Risk. Cites a CVE in CISA KEV.
  • Fri 6 Mar, 08:24 UTC. The Hacker News, its first report on the story. CISA flags CVE-2017-7921 CVE-2021-22681 amid Hikvision exploits. Cites a CVE in CISA KEV.
  • Fri 6 Mar, 09:57 UTC. Security Affairs, its first report on the story. CISA Adds CVEs to KEV for Apple Rockwell and Hikvision Flaws. Cites a CVE in CISA KEV.
  • Fri 6 Mar, 10:59 UTC. SOCRadar, its first report on the story. KEV adds CVE-2017-7921 and CVE-2021-22681 patch due by 26 Mar. Cites a CVE in CISA KEV.
  • Fri 6 Mar, 14:34 UTC. Dark Reading, its first report on the story. Iran weaponises cameras with CVEs to plan missile strikes. Cites a CVE in CISA KEV.
  • Sat 7 Mar, 10:55 UTC. Security Affairs. Iran-linked actors scan Hikvision and Dahua cams via VPN for CVEs. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 07:30 UTC. The Hacker News. CERT-UA reports attacks on Dahua cameras in Ukraine. Cites a CVE in CISA KEV.
  1. CERT-UA reports attacks on Dahua cameras in Ukraine
    The Hacker News · mentions it in passing
  2. Iran-linked actors scan Hikvision and Dahua cams via VPN for CVEs
    Security Affairs
  3. Iran weaponises cameras with CVEs to plan missile strikes
    Dark Reading
  4. KEV adds CVE-2017-7921 and CVE-2021-22681 patch due by 26 Mar
    SOCRadar
  5. CISA Adds CVEs to KEV for Apple Rockwell and Hikvision Flaws
    Security Affairs · mentions it in passing
  6. CISA flags CVE-2017-7921 CVE-2021-22681 amid Hikvision exploits
    The Hacker News
  7. KEV Adds Hikvision CVE-2017-7921 Privilege Escalation Risk
    CISA · official notice
  8. Hikvision CVE-2017-7921 Improper authentication enables access
    CISA · official notice
Show 2 more

New articles also arrive in the RSS feed.

References

CyberSIXTSignal over noise
Updated AboutDevelopersSign in