CVE-2017-7921 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2017-05-06

Added to CISA KEV: 2026-03-05 3225 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity
Immediately update all affected Hikvision cameras to firmware versions released after the vulnerability disclosure
Implement network segmentation to isolate camera networks from critical systems
Remove direct internet access to camera management interfaces and use VPN for remote access
Monitor network traffic to/from cameras for suspicious administrative activities
Change all default credentials and implement strong authentication where possible
Deploy network-based intrusion detection systems to monitor camera communications

🔍 Web Intelligence (Kagi · 2026-06-04)

CVE-2017-7921 is a critical vulnerability involving improper authentication in various Hikvision IP camera models ^[1] ^[3]. Because of its severity and ease of exploitation, it is included in the Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) Catalog ^[1].

Exploitation and Impact

Active Exploitation: The vulnerability is actively exploited in the wild, which is why it is listed in the CISA KEV catalog ^[1].
Attack Method: The flaw is an "Improper Authentication" issue, meaning the device fails to correctly verify user credentials during the login process ^[2] ^[3].
Requirements: It is a remote, network-based attack that does not require physical access to the device ^[3]. It typically does not require complex user interaction to execute.
Impact: Successful exploitation allows an attacker to bypass authentication, potentially gaining unauthorized access to the device, escalating privileges, and accessing sensitive information (such as video feeds or system configurations) ^[2] ^[4].
PoC Availability: Proof-of-concept (PoC) exploit code is publicly available on platforms like GitHub, often shared for educational or security research purposes ^[5].

Affected Products and Mitigation

Affected Versions: The vulnerability primarily affects Hikvision DS-2CD2xx2F-I Series cameras running firmware versions from V5.2.0 (build 140721) up to V5.4.0 (build 160530) ^[1]?id=CVE-2017-7921.
Status: This is a legacy vulnerability. The primary mitigation is to update the affected devices to the latest firmware versions provided by Hikvision for the specific model and region ^[4] ^[3]. Users are advised to consult Hikvision’s official security notifications to identify the specific "resolved" (patched) build for their hardware ^[3].

While information regarding specific, named ransomware campaigns targeting this exact CVE is less centralized than for more modern vulnerabilities, its inclusion in the CISA KEV catalog indicates that it is a high-priority target for threat actors and should be patched immediately to prevent unauthorized access and potential follow-on attacks ^[1].

Sources