LiveThreat Vulnerability Brief — CVE‑2017‑7921 (Improper Authentication in Hikvision Devices)
What It Is — CVE‑2017‑7921 is an improper‑authentication flaw in Hikvision video‑surveillance products that allows unauthenticated attackers to bypass login controls and gain full device access. The vulnerability scores 9.8 (Critical) on the CVSS v3.1 scale. Exploitability — CISA’s KEV listing confirms active exploitation in the wild, with publicly available proof‑of‑concept tools.
Affected Products — Hikvision IP cameras, NVRs, and related firmware; the advisory also references related Rockwell Automation industrial‑control components that share a similar attack surface.
TPRM Impact — Compromised cameras can expose sensitive video feeds, facilitate lateral movement into corporate networks, and jeopardize downstream customers that rely on these devices for security monitoring. The issue highlights the risk of integrating third‑party IoT/OT hardware without continuous vulnerability management.
Recommended Actions –
- Immediate patch: Deploy Hikvision’s latest firmware that mitigates CVE‑2017‑7921; verify Rockwell patches for any related CVEs.
- Network segmentation: Isolate surveillance/OT devices from core business systems and enforce strict firewall rules.
- Credential hygiene: Enforce strong, unique passwords and disable default accounts on all devices.
- Continuous monitoring: Enable logging and integrate device telemetry into a SIEM to detect anomalous access attempts.
- Third‑party risk review: Re‑assess contracts with Hikvision and Rockwell vendors, ensuring they meet your organization’s patch‑management SLA.
Source: The Hacker News