Hikvision Cameras - Authentication Bypass (CVE-2017-7921)

CVE-2017-7921 is a critical improper authentication vulnerability affecting multiple Hikvision camera models, allowing attackers to bypass authentication mechanisms. Exploitation of this flaw could enable unauthorized users to escalate privileges, access sensitive information, and potentially take full control of the affected devices remotely. This vulnerability poses a significant risk for surveillance environments, making it a prime target for attackers seeking to compromise security systems.

CrowdSec has been tracking this vulnerability and its exploits since 9th of March 2026.

Data from the CrowdSec community indicates that exploitation of CVE-2017-7921 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations. In addition, according to the CrowdSec network, attack volume against CVE-2017-7921 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit this vulnerability by sending unauthenticated requests to endpoints like /system/deviceInfo with a crafted auth parameter, allowing them to bypass authentication and access sensitive device information.