PT-2017-4054 · Hikvision · Hikvision Ds-2Cd2Xx2F-I Series+5

Published 2017-05-05 · Updated 2026-03-20 · CVE-2017-7921

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Hikvision DS-2CD2xx2F-I Series versions V5.2.0 build 140721 through V5.4.0 build 160530 Hikvision DS-2CD2xx0F-I Series versions V5.2.0 build 140721 through V5.4.0 Build 160401 Hikvision DS-2CD2xx2FWD Series versions V5.3.1 build 150410 through V5.4.4 Build 161125 Hikvision DS-2CD4x2xFWD Series versions V5.2.0 build 140721 through V5.4.0 Build 160414 Hikvision DS-2CD4xx5 Series versions V5.2.0 build 140721 through V5.4.0 Build 160421 Hikvision DS-2DFx Series versions V5.2.0 build 140805 through V5.4.5 Build 160928 Hikvision DS-2CD63xx Series versions V5.0.9 build 140305 through V5.3.5 Build 160106

Description An improper authentication issue exists in Hikvision IP cameras. The issue occurs when an application does not correctly authenticate users, potentially allowing a malicious user to elevate their privileges and access sensitive information. Evidence suggests this issue is being actively exploited.

Recommendations Hikvision DS-2CD2xx2F-I Series versions V5.2.0 build 140721 through V5.4.0 build 160530: Update to a newer version. Hikvision DS-2CD2xx0F-I Series versions V5.2.0 build 140721 through V5.4.0 Build 160401: Update to a newer version. Hikvision DS-2CD2xx2FWD Series versions V5.3.1 build 150410 through V5.4.4 Build 161125: Update to a newer version. Hikvision DS-2CD4x2xFWD Series versions V5.2.0 build 140721 through V5.4.0 Build 160414: Update to a newer version. Hikvision DS-2CD4xx5 Series versions V5.2.0 build 140721 through V5.4.0 Build 160421: Update to a newer version. Hikvision DS-2DFx Series versions V5.2.0 build 140805 through V5.4.5 Build 160928: Update to a newer version. Hikvision DS-2CD63xx Series versions V5.0.9 build 140305 through V5.3.5 Build 160106: Update to a newer version.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2021-01212

CVE-2017-7921

Affected Products

Hikvision Ds-2Cd2Xx0F-I Series

Hikvision Ds-2Cd2Xx2F-I Series

Hikvision Ds-2Cd4X2Xfwd Series

Hikvision Ds-2Cd4Xx5 Series

Hikvision Ds-2Cd63Xx Series

Hikvision Ds-2Dfx Series

References · 41

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/hikvision_unauth_pwd_reset_cve_2017_7921.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/hikvision_info_disclosure_cve_2017_7921.rb · Exploit
• 🔥 https://github.com/chrisjd20/hikvision_CVE-2017-7921_auth_bypass_config_decryptor · Exploit
• 🔥 https://github.com/JrDw0/CVE-2017-7921-EXP · Exploit
• 🔥 https://github.com/BurnyMcDull/CVE-2017-7921 · Exploit
• 🔥 https://github.com/K3ysTr0K3R/CVE-2017-7921-EXPLOIT · Exploit
• 🔥 https://github.com/MisakaMikato/cve-2017-7921-golang · Exploit
• 🔥 https://github.com/201646613/CVE-2017-7921 · Exploit
• 🔥 https://github.com/kooroshsanaei/HikVision-CVE-2017-7921 · Exploit
• 🔥 https://github.com/yousouf-Tasfin/cve-2017-7921-Mass-Exploit · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-7921 · Security Note
• https://hikvision.com/us-en/support/document-center/special-notices/privilege-escalating-vulnerability-in-certain-hikvision-ip-cameras · Security Note
• http://hikvision.com/us/about_10805.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01212 · Security Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-7921 · Note