Is CVE-2017-7921 actively exploited?

Yes. CVE-2017-7921 is being actively exploited in the wild according to CTIWatch exploit intelligence.

Can CVE-2017-7921 be exploited remotely?

Yes. CVE-2017-7921 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2017-7921?

CVE-2017-7921 has a CVSS score of 9.8 (CRITICAL).

HOME VULNERABILITIESCVE-2017-7921

CRITICALIN THE WILD

CVE-2017-7921

CWE-287Published: May 6, 2017· Updated: Jun 17, 2026

9.8

CVSS v3.1

Official Description

An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.

NVD Source

Risk Analysis

This critical vulnerability in Hikvision devices stems from improper authentication, allowing an unauthenticated attacker to escalate privileges and gain access to sensitive information. With a CVSS score of 9.8, this flaw poses a significant risk to the confidentiality, integrity, and availability of affected systems.

Active exploitation of this vulnerability has been observed in the wild. Given the CVSS vector AV:N and low complexity, this issue is remotely exploitable.

Recommended Action

Upgrade affected Hikvision DS-2CD2xx2F-I, DS-2CD2xx0F-I, DS-2CD2xx2FWD, DS-2CD4x2xFWD, DS-2CD4xx5, DS-2DFx, and DS-2CD63xx series devices to versions beyond those listed as vulnerable.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2017-7921 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.

Active exploitation of CVE-2017-7921 has been observed in the wild. Organizations should prioritize patching immediately regardless of CISA KEV status.

From a weakness classification perspective (CWE-287): Authentication bypass vulnerabilities allow attackers to access protected resources without valid credentials.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges Req.None

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Vendors & Products

hikvision116 product(s)

ds-2cd2032-i firmwareds-2cd2112-i firmwareds-2cd2132-i firmwareds-2cd2212-i5 firmwareds-2cd2232-i5 firmwareds-2cd2312-i firmwareds-2cd2332-i firmwareds-2cd2412f-i\(w\) firmwareds-2cd2432f-i\(w\) firmwareds-2cd2512f-i\(s\) firmwareds-2cd2532f-i\(s\) firmwareds-2cd2612f-i\(s\) firmware+104

Source: NVD CPE · 116 total CPE entries

Exploit & PoC Resources

ACTIVE EXPLOITATIONConfirmed exploitation in the wild

Exploit-DB

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

PacketStorm

Security advisories & exploits

External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

PATCHhttp://www.hikvision.com/us/about_10805.html

ADVISORYhttp://www.securityfocus.com/bid/98313

ADVISORYhttps://ics-cert.us-cert.gov/advisories/ICSA-17-124-01

ADVISORYhttp://www.securityfocus.com/bid/98313

ADVISORYhttps://ics-cert.us-cert.gov/advisories/ICSA-17-124-01

ADVISORYhttps://www.hikvision.com/cn/support/CybersecurityCenter/SecurityNotices/20170314/

ADVISORYhttps://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification--privilege-escalating-vulnerability-in-cer/

ADVISORYhttps://www.hikvision.com/us-en/support/document-center/special-notices/privilege-escalating-vulnerability-in-certain-hikvision-ip-cameras/

News & Research Mentioning CVE-2017-7921

Hikvision and Rockwell Automation CVSS 9.8 Flaws Added to CISA KEV Catalog

The Hacker News· Mar 6, 2026

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday added two security flaws impacting Hikvision and Rockwell Automation products to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The critical-severity vulnerabilities are listed below - CVE-2017-7921 (CVSS score: 9.8) - An improper authentication vulnerability affecting [xlite_meta score:50 src:The Hacker News xlite_fp:7c41e2e69fcba873d9ca6088c4c5010a556e3e79a533e20b4234eff6f8358f7d]

CISA Adds Five Known Exploited Vulnerabilities to Catalog

CISA Alerts· Mar 5, 2026

CISA has added five new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2017-7921 Hikvision Multiple Products Improper Authentication Vulnerability CVE-2021-22681 Rockwell Multiple Products Insufficient Protected Credentials Vulnerability CVE-2021-30952 Apple Multiple Products Integer Overflow or Wraparound Vulnerability CVE-2023-41974 Apple iOS and iPadOS Use-After-Free Vulnerability CVE-2023-43000 Apple Multiple products Use-After-Free Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vuln [xlite_meta score:60 src:CISA Alerts xlite_fp:165b5f850ff27845912a94f08bffe9b643bd34ae020914d5914015be5e7ed84e]