CVE-2017-7921: Hikvision IP Camera Improper Authentication Bypass (KEV)

CVE-2017-7921 is an improper-authentication vulnerability across seven Hikvision IP camera product series that lets an attacker escalate privileges and access video feeds and device data without valid credentials; it is NVD-Analyzed with an NVD Primary CVSS v3.1 score of 9.8 and confirmed present in the live CISA KEV catalog.

CVE-2017-7921 (CWE-287, Improper Authentication) was "discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices," per NVD, which notes the flaw occurs "when an application does not adequately or correctly authenticate users" and "may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information" (NVD).

NVD's own analysis gives it a Primary CVSS v3.1 score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required, full confidentiality/integrity/availability impact (the older CVSS v2 Primary score of 7.5 reflects the pre-2016 scoring model's lower ceiling for this impact profile) (NVD).

CISA's ICS advisory ICSA-17-124-01 covers this CVE alongside a related, separately tracked weakness (CVE-2017-7923, exposed credentials in a configuration file) across the same camera families, rates the authentication-bypass issue 10.0 critical, and states remediation requires updating to firmware V5.4.5 or V5.4.9 (released January-March 2017) obtained through an authorized Hikvision distributor — explicitly warning that "grey market" cameras with unauthorized firmware "cannot be safely updated." CISA's general ICS mitigations for this advisory include minimizing network exposure of camera devices, placing them behind firewalls isolated from business networks, and using VPNs rather than direct exposure for remote access (CISA ICS Advisory ICSA-17-124-01).

Hikvision's own security notice for the affected camera lines confirms the privilege-escalation issue and directs customers to its official firmware downloads for the fix, consistent with the fixed-version guidance in the CISA advisory (Hikvision Security Notice: Privilege Escalating Vulnerability in Certain Hikvision IP Cameras).

CISA added CVE-2017-7921 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-03-05, with a required-action due date of 2026-03-26; known ransomware campaign use is listed as "Unknown" and forensic-triage is not flagged (catalog version 2026.10.29, 1764 entries, confirmed live this run by exact cveID match) (CISA KEV).

As of 2026-10-29, FIRST scores the probability of exploitation at 0.99998 (99.99th percentile) — among the highest possible EPSS scores — reflecting the massive installed base of older Hikvision cameras, widespread automated scanning for this class of camera backdoor/authentication-bypass flaw, and years of in-the-wild botnet exploitation of similar Hikvision issues (FIRST EPSS).

Any camera from the affected series on firmware older than V5.4.5/V5.4.9 should be updated immediately through an authorized Hikvision distributor; devices running unauthorized "grey market" firmware cannot be safely patched and should be replaced, and any such camera should not be exposed directly to the internet in the meantime.

• Improper authentication across seven Hikvision IP camera series (listed with exact firmware build ranges) lets a malicious user escalate privileges and access sensitive information without valid credentials. — NVD
• NVD Primary CVSS v3.1 score is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); legacy CVSS v2 Primary score is 7.5. — NVD
• CISA's ICS advisory rates the flaw 10.0 critical, covers a related CVE-2017-7923 (exposed config-file credentials) on the same devices, requires updating to firmware V5.4.5/V5.4.9 via an authorized distributor, and warns grey-market firmware cannot be safely updated. — CISA ICS Advisory ICSA-17-124-01
• Hikvision's own security notice confirms the privilege-escalation vulnerability on the affected camera lines and directs customers to official firmware for remediation. — Hikvision Security Notice: Privilege Escalating Vulnerability in Certain Hikvision IP Cameras
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-03-05, required-action due date 2026-03-26; confirmed present in the live KEV feed by exact cveID match this run. — CISA KEV
• EPSS score is 0.99998 (99.99th percentile) as of 2026-10-29. — FIRST EPSS