Vulnerabilities / CVE-2017-7921

CVE-2017-7921

Published 2017-05-06 · published (not yet in NVD)

CVE-2017-7921

Exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-03-05, with a fix-by date of 2026-03-26. Patch it first.

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

9.8 CRITICAL
CVSS 3.1 · CNA

100%
chance of exploitation in the next 30 days (EPSS; in the top 1% of all CVEs)

An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.

Scores

9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCNA

Affected products

n/a Hikvision Cameras: Hikvision Cameras

Weakness: CWE-287

4 references (advisories, patches, write-ups)

https://ics-cert.us-cert.gov/advisories/ICSA-17-124-01 · x_refsource_MISC
http://www.securityfocus.com/bid/98313 · vdb-entry, x_refsource_BID
https://ghostbin.com/paste/q2vq2 · x_refsource_MISC
http://www.hikvision.com/us/about_10805.html · x_refsource_MISC

Sources: CVE.org, FIRST EPSS. Missing ones did not answer or have no record yet.

Look up another CVE Check your dependencies Scan a website