# CVE-2017-7921: Hikvision Cameras - Authentication Bypass

> Live exploitation tracking for CVE-2017-7921 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2017-7921

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Hikvision DS-2CD2xx2F-I
- **Weaknesses:** CWE-287 (Improper Authentication)
- **Tags:** iot

## Description

An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.

## CrowdSec analysis

[CVE-2017-7921](https://euvd.enisa.europa.eu/vulnerability/CVE-2017-7921) is a critical improper authentication vulnerability affecting multiple Hikvision camera models, allowing attackers to bypass authentication mechanisms. Exploitation of this flaw could enable unauthorized users to escalate privileges, access sensitive information, and potentially take full control of the affected devices remotely. This vulnerability poses a significant risk for surveillance environments, making it a prime target for attackers seeking to compromise security systems.

CrowdSec has been tracking this vulnerability and its exploits since 9th of March 2026.

Data from the CrowdSec community indicates that exploitation of CVE-2017-7921 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations.
In addition, according to the CrowdSec network, attack volume against CVE-2017-7921 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit this vulnerability by sending unauthenticated requests to endpoints like `/system/deviceInfo` with a crafted `auth` parameter, allowing them to bypass authentication and access sensitive device information.

## Timeline

- 2017-05-06: CVE Published. CVE-2017-7921 is published to NVD.
- 2026-03-05: CISA KEV. CVE-2017-7921 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2026-03-09: Rule Released. CrowdSec releases a rule to detect CVE-2017-7921 exploitation attempts against the CrowdSec Network.
- 2026-03-10: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2017-7921 for the first time.
- 2026-03-26: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-7921
- https://www.hikvision.com/cn/support/CybersecurityCenter/SecurityNotices/20170314/
- https://ics-cert.us-cert.gov/advisories/ICSA-17-124-01
- http://www.hikvision.com/us/about_10805.html
- https://www.hikvision.com/us-en/support/document-center/special-notices/privilege-escalating-vulnerability-in-certain-hikvision-ip-cameras/
- http://www.securityfocus.com/bid/98313
- https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification--privilege-escalating-vulnerability-in-cer/
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-7921.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2017-7921) follows observed exploitation activity for CVE-2017-7921. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.