Vulnerability · CVE-2017-7921

Hikvision Multiple Products Improper Authentication Vulnerability

Published May 5, 2017 · catalog updated Jun 16, 2026 · Hikvision Multiple Products

Patch now

CVE-2017-7921 is in the CISA known-exploited catalog, due Mar 26, 2026. Confirm Hikvision Multiple Products against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Gaps on this record

No version range is stored. A customer cannot check an installed version against this record.

Severity: Critical9.8
Known exploitation: CISA KEV and VulnCheck KEV
EPSS: 100.00%
Remediation: Remediation guidance
Affected products: cpe hikvision/ds-2cd2032-i firmware · cpe hikvision/ds-2cd2112-i firmware · cpe hikvision/ds-2cd2132-i firmware · cpe hikvision/ds-2cd2212-i5 firmware · cpe hikvision/ds-2cd2232-i5 firmware · cpe hikvision/ds-2cd2312-i firmware

An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

cpe hikvision/ds-2cd2032-i firmwareversion unspecified
cpe hikvision/ds-2cd2112-i firmwareversion unspecified
cpe hikvision/ds-2cd2132-i firmwareversion unspecified
cpe hikvision/ds-2cd2212-i5 firmwareversion unspecified
cpe hikvision/ds-2cd2232-i5 firmwareversion unspecified
cpe hikvision/ds-2cd2312-i firmwareversion unspecified
cpe hikvision/ds-2cd2332-i firmwareversion unspecified
cpe hikvision/ds-2cd2412f-i(w) firmwareversion unspecified
cpe hikvision/ds-2cd63xx series firmwareversion unspecified
cpe hikvision/ds-2dfx series firmwareversion unspecified
vendor Hikvision Multiple Productsversion unspecified

How to fix CVE-2017-7921

Recommended remediation
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA due date Mar 26, 2026.
Official advisories

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

Which versions are affected?

Affected version ranges are not on this record. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

What should an analyst verify?

CWE-287: Improper Authentication. EPSS 100.00%. The CISA KEV listing is the exploitation evidence. A public exploit reference is linked in Sources. That is not the same as confirmed exploitation. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

May 5, 2017 · Catalog
Detected
An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5
Mar 5, 2026 · CISA KEV
Known exploited
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Mar 26, 2026 · CISA KEV
Remediation due
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Jun 16, 2026 · Catalog
Updated
An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5

Sources

CISA KEVConfirmed exploitationCVE-2017-7921
Multiple Hikvision products contain an improper authentication vulnerability that could allow a malicious user to escalate privileges on the system and gain access to sensitive information.
cisa.gov
CVE.orgVulnerability recordCVE-2017-7921
Official CVE identifier
cve.org
FIRST EPSSExploitation probabilityCVE-2017-7921
30-day exploitation probability 100.0%
first.org
Metasploit ModulesPublic exploit moduleauxiliary_admin/http/hikvision_unauth_pwd_reset_cve_2017_7921
Public module reference (normal). Module source is not copied into this catalog.
rapid7.com
Metasploit ModulesPublic exploit moduleauxiliary_gather/hikvision_info_disclosure_cve_2017_7921
Public module reference (normal). Module source is not copied into this catalog.
rapid7.com
NIST NVDVulnerability recordCVE-2017-7921
An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.
nvd.nist.gov
VulnCheck KEVConfirmed exploitationCVE-2017-7921
Multiple Hikvision products contain an improper authentication vulnerability that could allow a malicious user to escalate privileges on the system and gain access to sensitive information.
vulncheck.com

References

Freshness

Last verified in this catalog Oct 17, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

Priority score

75/100

Evidence confidence: Very high

CISA lists this vulnerability as known to be exploited.

Confirmed exploitation30/30
EPSS probability20/20
CVSS severity15/15
Public exploit10/10
Internet exposure0/10
Product prevalence0/5
Threat research0/5

Decision signals

Four separate signals — do not infer one from another.

Critical

CVSS severity
9.8 v3.1
Technical impact. Separate from exploitation likelihood.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS probability
100.00% · p99.99%
Estimated probability of exploitation within 30 days (FIRST).
Known exploitation
Yes · CISA KEV and VulnCheck KEV
CISA KEV since Nov 18, 2023. Ransomware use: Unknown.
Patch availability
Remediation guidance
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Weakness

CWE-287
Improper Authentication
MITRE definition

Watch

A free account watches 5 technologies and gets a weekly digest. Professional adds immediate alerts.