An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I…

published 2017-05-06 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-16892

cvss: 9.8; version 3.1, CNA
cisa kev: Exploited; added 2026-03-05
epss: 100.0%; EPSS 100.0% chance of exploitation in 30 days, percentile 99.9%
public exploits: 2; Metasploit, plus a Nuclei check

An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.

Patch / fix

cisa required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

links 1

hikvision.com/us/about_10805.html advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-17-124-01 updated 2017-05-04 cvss 10.0

Hikvision Cameras

Hikvision DS- 2CD4x2xFWD Series >= 5.2.0 build 140721, <= 5.4.0 Build 160414 Hikvision DS-2CD2xx0F-I Series >= 5.2.0 build 140721, <= 5.4.0 Build 160401 Hikvision DS-2CD2xx2F-I Series >= 5.2.0 build 140721, <= 5.4.0 build 160530 Hikvision DS-2CD2xx2FWD Series >= 5.3.1 build 150410, <= 5.4.4 Build 161125 Hikvision DS-2CD4xx5 Series >= 5.2.0 build 140721, <= 5.4.0 Build 160421 Hikvision DS-2CD63xx Series >= 5.0.9 build 140305, <= 5.3.5 Build 160106

+1 more productsfewer

Hikvision DS-2DFx Series >= 5.2.0 build 140805, <= 5.4.5 Build 160928

affected: vendor fix, mitigation “In the Hikvision Unauthorized Distributors Notice, Hikvision encourages users to use devices sold by authorized distributers rather than so-called “grey market” devices”

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Timeline

2017-05-06 Published
2017-09-23 First public exploit (Metasploit auxiliary/admin/http/hikvision_unauth_pwd_reset_cve_2017_7921)
2026-03-05 CISA SSVC: exploitation active
2026-03-05 Added to CISA KEV
2026-03-26 CISA patch deadline

Known exploited

Added: 8 mo ago (2026-03-05)
Patch by: 2026-03-26 (7 mo ago)
Ransomware: Not known
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Vendor, product: Hikvision, Multiple Products
CISA name: Hikvision Multiple Products Improper Authentication Vulnerability

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: yes
Technical impact: total
Assessed: 8 mo ago (2026-03-05)

Exploit prediction

100.00% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit auxiliary/admin/http/hikvision_unauth_pwd_reset_cve_2017_7921 Hikvision IP Camera Unauthenticated Password Change Via Improper Authentication Logic metasploit auxiliary, normal rank, 2017-09-23
Metasploit auxiliary/gather/hikvision_info_disclosure_cve_2017_7921 Unauthenticated information disclosure such as configuration, credentials and camera snapshots of a vulnerable Hikvision IP Camera metasploit auxiliary, normal rank, 2017-09-23
Nuclei template Hikvision - Authentication Bypass nuclei detection template

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA	3.1	9.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

n/a Hikvision Cameras

Classification

Weakness

CWE-287 Improper Authentication

References

hikvision.com /us/about_10805.html
patch, vendor-advisory
ics-cert.us-cert.gov /advisories/ICSA-17-124-01
third-party-advisory, us-government-resource
securityfocus.com /bid/98313
vdb-entry, broken-link, third-party-advisory
ghostbin.com /paste/q2vq2
broken-link
hikvision.com /us-en/support/document-center/special-notices/privilege-escalating-vulnerability-in-certain-hikvision-ip-came
third-party-advisory
hikvision.com /cn/support/CybersecurityCenter/SecurityNotices/20170314/
third-party-advisory
hikvision.com /en/support/cybersecurity/security-advisory/security-notification--privilege-escalating-vulnerability-in-cer/
third-party-advisory
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-7921
government-resource, us-government-resource

Sources

CVE List CVE-2017-7921
NVD CVE-2017-7921

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary