Hikvision Multiple Products Improper Authentication Vulnerability
n/a — Hikvision Cameras
An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.
9.8
100.0%
Vector breakdown
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Published
- May 6, 2017
- Modified
- Jun 17, 2026
- Added to KEV
- Mar 5, 2026
- Federal patch due
- Mar 26, 2026
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Weakness classification
Affected packages
Proof-of-concept & exploitation references
8 foundWeaponization
Public repositories whose name or description references CVE-2017-7921, found via a live GitHub search at request time. These are community-sourced signals, not a verified working exploit - cross-check each one before relying on it, and treat higher star counts and recent activity as (weak) corroboration, not proof.
- chrisjd20/hikvision_CVE-2017-7921_auth_bypass_config_decryptor★ 116
This python file will decrypt the configurationFile used by hikvision cameras vulnerable to CVE-2017-7921.
updated Oct 9, 2026
- JrDw0/CVE-2017-7921-EXP★ 103
Hikvision camera CVE-2017-7921-EXP
updated Oct 17, 2026
- BurnyMcDull/CVE-2017-7921★ 35
海康威视未授权访问检测poc及口令爆破
updated Sep 2, 2026
- voidsshadows/Hikvision-City-Hunter★ 19
This tool is a modern evolution of older PoCs like those for CVE-2017-7921 and ICSA-17-124-01, updated for 2025 with live console output, threading for speed, and honeypot filtering (skips devices with >12 open ports). It's built for red teamers, bug bounty hunters, and security researchers to identify
updated Jul 13, 2026
- MisakaMikato/cve-2017-7921-golang★ 13
Hikvision IP camera access bypass exploit, developed by golang.
updated Aug 24, 2026
- Th3Purge/CVE-2017-7921-Exploit★ 9
Exploit for CVE-2017-7921, targeting the improper authentication vulnerability affecting Hikvision camera systems.
updated Oct 2, 2026
- kooroshsanaei/HikVision-CVE-2017-7921★ 7
Test For CVE-2017–7921;
updated Sep 30, 2026
- alkaid176/CVE-2017-7921★ 6
CVE-2017-7921-EXP Hikvision camera
updated Jun 26, 2024
References
Frequently asked questions
What is CVE-2017-7921?
An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.
How severe is CVE-2017-7921?
CVE-2017-7921 has a CVSS base score of 9.8 out of 10 (CVSS 3.1).
Is CVE-2017-7921 actively exploited in the wild?
Yes. CVE-2017-7921 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added Mar 5, 2026, meaning CISA has confirmed evidence of active exploitation.
What is the EPSS score for CVE-2017-7921?
100.0% - meaning FIRST.org's EPSS model estimates a 100.0% probability this vulnerability will be exploited in the wild within 30 days (100% percentile among all scored CVEs).
Is there exploit tooling available for CVE-2017-7921?
Yes - a public Nuclei template referencing CVE-2017-7921 exist in public repositories we checked. We also found 8 public GitHub repositories referencing this CVE.
What type of vulnerability is CVE-2017-7921?
CVE-2017-7921 is classified under CWE-287.
Cross-checked against
Impactr finds and proves whether CVE-2017-7921 - or flaws like it - are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.
Join the waitlist