{"id":"CVE-2017-7921","aliases":["EUVD-2017-16892","GHSA-82r9-7ww3-jr86"],"status":"published","title":"An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build...","description":"An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.99998,"percentile":0.9999,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-287"],"published":"2017-05-06T00:00:00Z","modified":"2026-06-17T01:25:28Z","kev":{"date_added":"2026-03-05","due_date":"2026-03-26","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2026-03-05"},{"source":"kev","since":"2026-03-05"}],"exploits":[{"source":"pocgithub","id":"JrDw0/CVE-2017-7921-EXP","title":"JrDw0/CVE-2017-7921-EXP","date":"2020-04-27","url":"https://github.com/JrDw0/CVE-2017-7921-EXP"},{"source":"pocgithub","id":"BurnyMcDull/CVE-2017-7921","title":"BurnyMcDull/CVE-2017-7921","date":"2020-11-12","url":"https://github.com/BurnyMcDull/CVE-2017-7921"},{"source":"pocgithub","id":"MisakaMikato/cve-2017-7921-golang","title":"MisakaMikato/cve-2017-7921-golang","date":"2020-11-13","url":"https://github.com/MisakaMikato/cve-2017-7921-golang"},{"source":"pocgithub","id":"chrisjd20/hikvision_CVE-2017-7921_auth_bypass_config_decryptor","title":"chrisjd20/hikvision_CVE-2017-7921_auth_bypass_config_decryptor","date":"2021-01-29","url":"https://github.com/chrisjd20/hikvision_CVE-2017-7921_auth_bypass_config_decryptor"},{"source":"pocgithub","id":"p4tq/hikvision_CVE-2017-7921_auth_bypass_config_decryptor","title":"p4tq/hikvision_CVE-2017-7921_auth_bypass_config_decryptor","date":"2022-06-15","url":"https://github.com/p4tq/hikvision_CVE-2017-7921_auth_bypass_config_decryptor"},{"source":"pocgithub","id":"alkaid176/CVE-2017-7921","title":"alkaid176/CVE-2017-7921","date":"2022-07-20","url":"https://github.com/alkaid176/CVE-2017-7921"},{"source":"pocgithub","id":"inj3ction/CVE-2017-7921-EXP","title":"inj3ction/CVE-2017-7921-EXP","date":"2022-10-19","url":"https://github.com/inj3ction/CVE-2017-7921-EXP"},{"source":"pocgithub","id":"krypton612/hikivision","title":"krypton612/hikivision","date":"2023-07-04","url":"https://github.com/krypton612/hikivision"},{"source":"pocgithub","id":"AnonkiGroup/AnonHik","title":"AnonkiGroup/AnonHik","date":"2023-10-23","url":"https://github.com/AnonkiGroup/AnonHik"},{"source":"pocgithub","id":"b3pwn3d/CVE-2017-7921","title":"b3pwn3d/CVE-2017-7921","date":"2023-11-20","url":"https://github.com/b3pwn3d/CVE-2017-7921"},{"source":"pocgithub","id":"kooroshsanaei/HikVision-CVE-2017-7921","title":"kooroshsanaei/HikVision-CVE-2017-7921","date":"2024-07-02","url":"https://github.com/kooroshsanaei/HikVision-CVE-2017-7921"},{"source":"pocgithub","id":"aengussong/hikvision_probe","title":"aengussong/hikvision_probe","date":"2024-11-26","url":"https://github.com/aengussong/hikvision_probe"},{"source":"pocgithub","id":"GabrielAvls/CVE-2017-7921","title":"GabrielAvls/CVE-2017-7921","date":"2025-01-24","url":"https://github.com/GabrielAvls/CVE-2017-7921"},{"source":"pocgithub","id":"lastvocher/Hikvision-CVE-2017-7921-decryptor","title":"lastvocher/Hikvision-CVE-2017-7921-decryptor","date":"2025-10-08","url":"https://github.com/lastvocher/Hikvision-CVE-2017-7921-decryptor"},{"source":"pocgithub","id":"voidsshadows/Hikvision-City-Hunter","title":"voidsshadows/Hikvision-City-Hunter","date":"2025-11-19","url":"https://github.com/voidsshadows/Hikvision-City-Hunter"},{"source":"pocgithub","id":"0xf3d0rq/CVE-2017-7921","title":"0xf3d0rq/CVE-2017-7921","date":"2025-11-27","url":"https://github.com/0xf3d0rq/CVE-2017-7921"},{"source":"pocgithub","id":"saaydmr/hikvision-exploiter","title":"saaydmr/hikvision-exploiter","date":"2026-01-21","url":"https://github.com/saaydmr/hikvision-exploiter"},{"source":"pocgithub","id":"Wyl-cmd/CVE-2017-7921-Research-Toolkit","title":"Wyl-cmd/CVE-2017-7921-Research-Toolkit","date":"2026-01-28","url":"https://github.com/Wyl-cmd/CVE-2017-7921-Research-Toolkit"},{"source":"pocgithub","id":"mverschu/CVE-2017-7921","title":"mverschu/CVE-2017-7921","date":"2026-02-09","url":"https://github.com/mverschu/CVE-2017-7921"},{"source":"pocgithub","id":"KelvinWin10/CVE-2017-7921-rewrite","title":"KelvinWin10/CVE-2017-7921-rewrite","date":"2026-02-15","url":"https://github.com/KelvinWin10/CVE-2017-7921-rewrite"},{"source":"pocgithub","id":"MK-ULTRA-project-monarch/CVE-2017-7921-Writeup-2026","title":"MK-ULTRA-project-monarch/CVE-2017-7921-Writeup-2026","date":"2026-07-14","url":"https://github.com/MK-ULTRA-project-monarch/CVE-2017-7921-Writeup-2026"},{"source":"pocgithub","id":"xjghnxhlh/hikihack","title":"xjghnxhlh/hikihack","date":"2026-08-02","url":"https://github.com/xjghnxhlh/hikihack"},{"source":"pocgithub","id":"Th3Purge/CVE-2017-7921-Exploit","title":"Th3Purge/CVE-2017-7921-Exploit","date":"2026-09-11","url":"https://github.com/Th3Purge/CVE-2017-7921-Exploit"},{"source":"pocgithub","id":"m7arm4n/CVE-2017-7921","title":"m7arm4n/CVE-2017-7921","date":"2026-10-14","url":"https://github.com/m7arm4n/CVE-2017-7921"},{"source":"pocgithub","id":"MK-ULTRA-MK-ULTRA/CVE-2017-7921-2026-writeup","title":"MK-ULTRA-MK-ULTRA/CVE-2017-7921-2026-writeup","date":"2026-10-27","url":"https://github.com/MK-ULTRA-MK-ULTRA/CVE-2017-7921-2026-writeup"},{"source":"metasploit","id":"auxiliary/admin/http/hikvision_unauth_pwd_reset_cve_2017_7921","title":"Hikvision IP Camera Unauthenticated Password Change Via Improper Authentication Logic","type":"auxiliary","date":"2017-09-23","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/admin/http/hikvision_unauth_pwd_reset_cve_2017_7921"},{"source":"metasploit","id":"auxiliary/gather/hikvision_info_disclosure_cve_2017_7921","title":"Unauthenticated information disclosure such as configuration, credentials and camera snapshots of a vulnerable Hikvision IP Camera","type":"auxiliary","date":"2017-09-23","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921"},{"source":"nuclei","id":"CVE-2017-7921","title":"Hikvision - Authentication Bypass","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-7921.yaml"}],"exploits_more":3,"products":[{"vendor":"hikvision","product":"ds-2cd2032-i_firmware"},{"vendor":"hikvision","product":"ds-2cd2112-i_firmware"},{"vendor":"hikvision","product":"ds-2cd2132-i_firmware"},{"vendor":"hikvision","product":"ds-2cd2212-i5_firmware"},{"vendor":"hikvision","product":"ds-2cd2232-i5_firmware"},{"vendor":"hikvision","product":"ds-2cd2312-i_firmware"},{"vendor":"hikvision","product":"ds-2cd2332-i_firmware"},{"vendor":"hikvision","product":"ds-2cd2412f-i\\(w\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd2432f-i\\(w\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd2512f-i\\(s\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd2532f-i\\(s\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd2612f-i\\(s\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd2632f-i\\(s\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd2712f-i\\(s\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd2732f-i\\(s\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd2t32-i3_firmware"},{"vendor":"hikvision","product":"ds-2cd2t32-i5_firmware"},{"vendor":"hikvision","product":"ds-2cd2t32-i8_firmware"},{"vendor":"hikvision","product":"ds-2cd4012f-\\(a\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4012f-\\(p\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4012f-\\(w\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4012fwd-\\(a\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4012fwd-\\(p\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4012fwd-\\(w\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4024f-\\(a\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4024f-\\(p\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4024f-\\(w\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4032fwd-\\(a\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4032fwd-\\(p\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4032fwd-\\(w\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4112f-i\\(z\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4112fwd-i\\(z\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4124f-i\\(z\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4132fwd-i\\(z\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4212f-i\\(h\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4212f-i\\(s\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4212f-i\\(z\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4212fwd-i\\(h\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4212fwd-i\\(s\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4212fwd-i\\(z\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4224f-i\\(h\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4224f-i\\(s\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4224f-i\\(z\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4232fwd-i\\(h\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4232fwd-i\\(s\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4232fwd-i\\(z\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4312f-i\\(h\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4312f-i\\(s\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4312f-i\\(z\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4324f-i\\(h\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4324f-i\\(s\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4324f-i\\(z\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4332fwd-i\\(h\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4332fwd-i\\(s\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd4332fwd-i\\(z\\)_firmware"},{"vendor":"hikvision","product":"ds-2cd63xx_series_firmware"},{"vendor":"hikvision","product":"ds-2cd6412fwd_firmware"},{"vendor":"hikvision","product":"ds-2dfx_series_firmware"},{"vendor":"hikvision","product":"multiple products"}],"references":[{"url":"https://ics-cert.us-cert.gov/advisories/ICSA-17-124-01","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","US Government Resource"]},{"url":"http://www.securityfocus.com/bid/98313","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://ghostbin.com/paste/q2vq2","tags":["x_refsource_MISC","x_transferred","Broken Link"]},{"url":"http://www.hikvision.com/us/about_10805.html","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory"]},{"url":"https://www.hikvision.com/us-en/support/document-center/special-notices/privilege-escalating-vulnerability-in-certain-hikvision-ip-cameras/","tags":["Third Party Advisory"]},{"url":"https://www.hikvision.com/cn/support/CybersecurityCenter/SecurityNotices/20170314/","tags":["Third Party Advisory"]},{"url":"https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification--privilege-escalating-vulnerability-in-cer/","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-7921","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7921"},{"url":"https://www.hikvision.com/cn/support/CybersecurityCenter/SecurityNotices/20170314"},{"url":"https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification--privilege-escalating-vulnerability-in-cer"},{"url":"https://www.hikvision.com/us-en/support/document-center/special-notices/privilege-escalating-vulnerability-in-certain-hikvision-ip-cameras"},{"url":"https://github.com/advisories/GHSA-82r9-7ww3-jr86"}],"sources":{"cve":[{"id":"CVE-2017-7921","description":"An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.","status":"published","published":"2017-05-06T00:00:00Z","modified":"2026-03-06T05:01:18.718Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:33:20.843976Z"}],"euvd":[{"id":"EUVD-2017-16892","description":"An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.","status":"published","published":"2017-05-06T00:00:00Z","modified":"2026-03-06T05:01:18Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2026-03-05","updated_at":"2026-11-02T19:48:08.258323Z"}],"ghsa":[{"id":"GHSA-82r9-7ww3-jr86","title":"An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build...","description":"An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.","status":"published","published":"2022-05-17T00:13:28Z","modified":"2026-03-05T21:31:32Z","cvss":[{"version":"3.0","score":10,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:06:28.064128Z"}],"kev":[{"id":"CVE-2017-7921","title":"Hikvision Multiple Products Improper Authentication Vulnerability","description":"Multiple Hikvision products contain an improper authentication vulnerability that could allow a malicious user to escalate privileges on the system and gain access to sensitive information.","cwes":["CWE-287"],"kev":{"date_added":"2026-03-05","due_date":"2026-03-26","required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:15.999436Z"}],"nvd":[{"id":"CVE-2017-7921","description":"An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.","status":"published","published":"2017-05-06T00:29:00.35Z","modified":"2026-06-17T01:25:28.927Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:03:47.848196Z"}]}}