Quantum Secular Labs / Blog / Advisories
CVE-2017-7921: Hikvision Multiple Products Improper Authentication Vulnerability
CVE-2017-7921 is rated critical with a CVSS v3.1 base score of 9.8 and affects Hikvision Multiple Products, along with 58 other products in NVD’s configuration data. Per its scoring, it can be exploited over the network, without authentication, without any user interaction. The scored impact on confidentiality, integrity and availability is the highest available. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-03-05, which means exploitation in the wild has been observed.
Vulnerability description
An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.
Severity breakdown
CVSS v3.1 9.8: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Attack vector: Network. Exploitable remotely over the network, with no need for local or physical access.
- Attack complexity: Low. No special conditions; the attack can be repeated reliably.
- Privileges required: None. No account or prior access is needed.
- User interaction: None. No action from any user is needed.
- Scope: Unchanged. Impact stays within the vulnerable component.
- Confidentiality impact: High. Total loss of confidentiality; sensitive data can be fully disclosed.
- Integrity impact: High. Total loss of integrity; data or system state can be fully modified.
- Availability impact: High. Total loss of availability; the component can be shut down.
Underlying weakness
CWE-287: Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Affected products
- Hikvision Ds 2cd2032 I Firmware: all versions listed by NVD
- Hikvision Ds 2cd2112 I Firmware: all versions listed by NVD
- Hikvision Ds 2cd2132 I Firmware: all versions listed by NVD
- Hikvision Ds 2cd2212 I5 Firmware: all versions listed by NVD
- Hikvision Ds 2cd2232 I5 Firmware: all versions listed by NVD
- Hikvision Ds 2cd2312 I Firmware: all versions listed by NVD
- Hikvision Ds 2cd2332 I Firmware: all versions listed by NVD
- Hikvision Ds 2cd2412f I(W) Firmware: all versions listed by NVD
- Hikvision Ds 2cd2432f I(W) Firmware: all versions listed by NVD
- Hikvision Ds 2cd2512f I(S) Firmware: all versions listed by NVD
- Hikvision Ds 2cd2532f I(S) Firmware: all versions listed by NVD
- Hikvision Ds 2cd2612f I(S) Firmware: all versions listed by NVD
- Hikvision Ds 2cd2632f I(S) Firmware: all versions listed by NVD
- Hikvision Ds 2cd2712f I(S) Firmware: all versions listed by NVD
- Hikvision Ds 2cd2732f I(S) Firmware: all versions listed by NVD
References
- http://www.hikvision.com/us/about_10805.html
- http://www.securityfocus.com/bid/98313
- https://ics-cert.us-cert.gov/advisories/ICSA-17-124-01
- https://www.hikvision.com/cn/support/CybersecurityCenter/SecurityNotices/20170314/
- https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification--privilege-escalating-vulnerability-in-cer/
- https://www.hikvision.com/us-en/support/document-center/special-notices/privilege-escalating-vulnerability-in-certain-hikvision-ip-cameras/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-7921
- https://ghostbin.com/paste/q2vq2