CVE-2017-7921 Hikvision Multiple Products Improper Authentication

Exploited in the wild Critical 9.8 Published 6 May 2017 Updated 6 Mar 2026

Improper authentication in Hikvision cameras allows attackers to escalate privileges and access sensitive information.

Exploited in the wild: Since 5 Mar 2026
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2017-7921?

CVE-2017-7921 is a critical authentication bypass vulnerability in Hikvision Cameras, published on 6 May 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.

Weakness: CWE-287

Which versions are affected by CVE-2017-7921?

It affects 58 products.

Products include Hikvision Ds-2cd2032-I Firmware, Hikvision Ds-2cd2112-I Firmware, Hikvision Ds-2cd2132-I Firmware, Hikvision Ds-2cd2212-I5 Firmware, Hikvision Ds-2cd2232-I5 Firmware, Hikvision Ds-2cd2312-I Firmware and 52 more.

How do I fix CVE-2017-7921?

No fix has been published for CVE-2017-7921 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 26 Mar 2026.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2017-7921 being exploited?

Yes. Attackers have exploited CVE-2017-7921 in the wild since at least 5 Mar 2026.

Public exploit code: 2 Metasploit modules, 1 Nuclei template and 25 proofs of concept on GitHub.

CVE-2017-7923 Hardcoded credentials in Hikvision Cameras High 8.8

Sources

Also known as GHSA-82r9-7ww3-jr86.