Hikvision Multiple Products Improper Authentication Vulnerability (CVE-2017-7921)

What is affected, what to do

An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users.

The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Hikvision Cameras eq Hikvision Cameras..Hikvision Cameras

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Patch firmware on every affected Hikvision model (DS-2CD2xx2F-I, DS-2CD2xx0F-I, DS-2CD2xx2FWD, DS-2CD4x2xFWD, DS-2CD4xx5, DS-2DFx, DS-2CD63xx) to a build above the ranges listed in the CVE. Pull the exact target firmware from the Hikvision support portal or your distributor — fixed build numbers differ per model line.
   • Inventory first: scan every VLAN for Hikvision devices on TCP/80, TCP/8000 (SDK), TCP/554 (RTSP) and TCP/443. Match HTTP banners „App-webs" or „DNVRS-Webs" against the asset register.
   • Kill internet exposure immediately: remove any NAT/port-forward for the camera web UI, SDK port 8000 and RTSP at the perimeter firewall; disable UPnP on edge routers.
   • Reset admin passwords. Because this is an authentication bypass, every account that was previously reachable must be treated as compromised — rotate credentials after the firmware update, not before.
   • Review the upstream NVR/VMS (iVMS-4200, Blue Iris, Milestone, etc.). Stolen camera credentials are frequently reused as a pivot; rotate service accounts there too.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: move cameras into a dedicated VLAN with no internet egress. Only the VMS server may initiate TCP/80 and TCP/8000 inbound to cameras; return traffic restricted to RTSP (TCP/554 plus the RTP/UDP range).
   • Egress filtering: allow cameras outbound only to NTP, DNS and the VMS. Drop everything else at the L3 switch or firewall, especially Telnet/23, SSH/22 and arbitrary IRC ports typically used by Mirai-family loaders.
   • If remote access is operationally required, front-end with VPN plus a reverse proxy. Block direct URLs such as /System/configurationFile and /Security/users, and requests carrying the ?auth= query string, at the proxy.
   • Hardening: disable Telnet, SSH and UPnP in the camera web UI; remove unused ONVIF users; enable „Illegal Login Lock".
   • Lifecycle: any model for which the vendor no longer ships firmware above the vulnerable builds (end-of-support) belongs in the NIS2 risk treatment plan as a replacement item.
3. 03

   Runbook step 3

   Detection rules

   • Parse camera / reverse-proxy access logs for requests containing the query string auth=YWRtaW46MTEK or any GET to /System/configurationFile — the canonical PoC path for config extraction.
   • Suricata/Snort: alert on HTTP requests to /Security/users or /System/configurationFile that return HTTP 200 without a preceding 401. Example: content:"GET /System/configurationFile?auth="; http_method; nocase;.
   • Zeek http.log or firewall flow logs: spikes in inbound TCP/80 or TCP/8000 to camera IPs from unexpected source ASNs. KQL sketch: CommonSecurityLog | where DestinationPort in (80,8000) | where DestinationIP in (CameraList) | summarize count() by SourceIP, bin(TimeGenerated, 1h) | where count_ > 50.
   • NetFlow/IPFIX: outbound connections from camera IPs to TCP/23, TCP/2323, TCP/6667 or known Mirai C2 indicators — strong signal of post-exploitation botnet enrolment.
   • VMS audit log: alert on unexpected config changes, new users, altered RTSP streams or firmware downgrades, and correlate in the SIEM.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.

Source: NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Hikvision

Weakness classes (CWE)

• CWE-287Improper Authentication

  Class

  When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

  Entry at MITRE CWE-287

References & sources

• ics-cert.us-cert.govadvisories/ICSA-17-124-01x_refsource_MISC, Third-party advisory, US government resource
• securityfocus.com98313Vulnerability database, x_refsource_BID, Broken link, Third-party advisory, Vulnerability database
• ghostbin.compaste/q2vq2x_refsource_MISC, Broken link
• hikvision.comus/about_10805.htmlx_refsource_MISC, Patch, Vendor advisory
• hikvision.comus-en/support/document-center/special-notices/privilege-escalat…Third-party advisory
• hikvision.comcn/support/CybersecurityCenter/SecurityNotices/20170314Third-party advisory
• hikvision.comen/support/cybersecurity/security-advisory/security-notificatio…Third-party advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2017-7921government-resource, US government resource