Hikvision IP cameras and recorders: 2017 authentication flaw CVE-2017-7921 listed by CISA as exploited
CISA listed an old Hikvision camera flaw (CVE-2017-7921) as exploited on 5 Mar 2026. Attackers can bypass login on unpatched cameras and recorders. Update the firmware from Hikvision, change default passwords, and don't expose the device to the internet.
Update every Hikvision camera and recorder (including rebranded ones) to the latest firmware from Hikvision, replace default or weak passwords, and keep the devices off the open internet. If a model no longer gets updates, take it off the internet or replace it.
- Hikvision IP cameras and DVRsno fixed version yet
What’s happening
On 5 March 2026 the US cyber agency CISA added CVE-2017-7921 to its list of flaws being used in attacks. It is an improper authentication flaw in multiple Hikvision products, mainly IP cameras and recorders (DVRs), including rebranded versions sold by other companies. It can let an attacker get around the login, raise their privileges and read sensitive information such as configuration files and credentials. It carries a CVSS score of 9.8 on NVD, and some trackers list 10. Hikvision fixed the flaw in 2017, according to Field Effect, so the risk is to devices that were never updated. Field Effect reports that the SANS Internet Storm Center saw a renewed wave of attempts on 24 September 2025, paired with password guessing, and that the Zerobot malware abused the flaw in 2022. HARD could not read Hikvision's own notice, so the affected models and fixed firmware versions are not confirmed here. Check Hikvision's notice for your model.
- What
- Flaw
- Affects
- Hikvision IP cameras and DVR/NVR recorders (including OEM-branded models)
- Affected
- Multiple Hikvision products (IP cameras and DVRs, including OEM-rebranded devices) on outdated firmware; exact models and versions are in Hikvision's special notice, which HARD could not read
- Fixed in
- No fix yet
- Since
- 5 Mar 2026
- Closed
- 5 Mar 2026
Timeline
- CISA added
CISA added CVE-2017-7921 to its Known Exploited Vulnerabilities catalogue on the basis of active exploitation. Secondary reports give a federal agency fix deadline of 26 March 2026.
- Wider attacks
The SANS Internet Storm Center saw a new wave of attempts to exploit the flaw against exposed Hikvision devices, combined with guessing weak or default passwords, to pull out configuration files, credentials and snapshots.
- Made publicPartly fixed
Hikvision fixed the improper authentication flaw CVE-2017-7921 in certain IP cameras and recorders in June 2017, according to Field Effect. Specific fixed firmware versions were not given in the pages HARD could read.
Sources
- Privilege-escalating vulnerability in certain Hikvision IP cameras (Hikvision special notice; page could not be read)Hikvision · 5 Mar 2026
- Legacy Hikvision vulnerability resurfacesField Effect · 1 Oct 2025
- Hikvision camera vulnerability actively exploited, CISA warns agencies to patch immediatelyVPNCentral · 6 Mar 2026