10
CVSSv3

CVE-2017-7921

Published: 06/05/2017 Updated: 19/12/2017
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
CVSS v3 Base Score: 10 | Impact Score: 6 | Exploitability Score: 3.9
VMScore: 672
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

An Improper Authentication issue exists in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421, DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928, and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

hikvision ds-2cd2732f-i\\(s\\)_firmware -

hikvision ds-2cd2712f-i\\(s\\)_firmware -

hikvision ds-2cd2212-i5_firmware -

hikvision ds-2cd2232-i5_firmware -

hikvision ds-2cd4012f-\\(a\\)_firmware -

hikvision ds-2cd4012f-\\(p\\)_firmware -

hikvision ds-2cd4032fwd-\\(w\\)_firmware -

hikvision ds-2cd4112f-i\\(z\\)_firmware -

hikvision ds-2cd4112fwd-i\\(z\\)_firmware -

hikvision ds-2cd4212f-i\\(h\\)_firmware -

hikvision ds-2cd4212f-i\\(s\\)_firmware -

hikvision ds-2cd4312f-i\\(z\\)_firmware -

hikvision ds-2cd4312f-i\\(h\\)_firmware -

hikvision ds-2cd2412f-i\\(w\\)_firmware -

hikvision ds-2cd2432f-i\\(w\\)_firmware -

hikvision ds-2cd2112-i_firmware -

hikvision ds-2cd2032-i_firmware -

hikvision ds-2cd4012fwd-\\(p\\)_firmware -

hikvision ds-2cd4012fwd-\\(w\\)_firmware -

hikvision ds-2cd4032fwd-\\(a\\)_firmware -

hikvision ds-2cd4032fwd-\\(p\\)_firmware -

hikvision ds-2cd4132fwd-i\\(z\\)_firmware -

hikvision ds-2cd4212f-i\\(z\\)_firmware -

hikvision ds-2cd4232fwd-i\\(h\\)_firmware -

hikvision ds-2cd4232fwd-i\\(s\\)_firmware -

hikvision ds-2cd4324f-i\\(z\\)_firmware -

hikvision ds-2cd4324f-i\\(h\\)_firmware -

hikvision ds-2cd4324f-i\\(s\\)_firmware -

hikvision ds-2cd6412fwd_firmware -

hikvision ds-2cd2632f-i\\(s\\)_firmware -

hikvision ds-2cd2612f-i\\(s\\)_firmware -

hikvision ds-2cd2312-i_firmware -

hikvision ds-2cd2t32-i3_firmware -

hikvision ds-2cd2t32-i5_firmware -

hikvision ds-2cd4012f-\\(w\\)_firmware -

hikvision ds-2cd4024f-\\(a\\)_firmware -

hikvision ds-2cd4124f-i\\(z\\)_firmware -

hikvision ds-2cd4212fwd-i\\(z\\)_firmware -

hikvision ds-2cd4224f-i\\(z\\)_firmware -

hikvision ds-2cd4224f-i\\(h\\)_firmware -

hikvision ds-2cd4312f-i\\(s\\)_firmware -

hikvision ds-2cd4332fwd-i\\(z\\)_firmware -

hikvision ds-2cd2512f-i\\(s\\)_firmware -

hikvision ds-2cd2532f-i\\(s\\)_firmware -

hikvision ds-2cd2332-i_firmware -

hikvision ds-2cd2132-i_firmware -

hikvision ds-2cd2t32-i8_firmware -

hikvision ds-2cd4012fwd-\\(a\\)_firmware -

hikvision ds-2cd4024f-\\(p\\)_firmware -

hikvision ds-2cd4024f-\\(w\\)_firmware -

hikvision ds-2cd4212fwd-i\\(h\\)_firmware -

hikvision ds-2cd4212fwd-i\\(s\\)_firmware -

hikvision ds-2cd4224f-i\\(s\\)_firmware -

hikvision ds-2cd4232fwd-i\\(z\\)_firmware -

hikvision ds-2cd4332fwd-i\\(h\\)_firmware -

hikvision ds-2cd4332fwd-i\\(s\\)_firmware -

hikvision ds-2dfx_series_firmware -

hikvision ds-2cd63xx_series_firmware -

Vendor Advisories

Check Point Reference: CPAI-2017-1803 Date Published: 20 Feb 2024 Severity: Critical ...

Github Repositories

海康威视未授权访问检测poc及口令爆破

CVE-2017-7921 海康威视未授权访问检测poc及口令检测 使用方法Usage: Usage: -a 加载Poc模块 -b 加载密码爆破模块 -e 加载Exp模块 -f string 文件名称 默认为空 -i string 输入ip地址 eg:192001-19200255 -p string 密码 default:12345 (default "12345") -s string 协议 eg:

CVE-2017-7921-EXP Hikvision camera

CVE-2017-7921 CVE-2017-7921-EXP Hikvision camera 本工具主要面向于合法授权的渗透测试安全人员以及进行常规操作的网站管理员。 任何人不得将其用于非法用途以及盈利等目的,否则后果自行承担并将追究其相关责任! 使用帮助 --rhost 目标主机 --rport 目标端口 --level 测试等级: --level 1 检测漏洞

CVE-2017-7921 Exploit An Improper Authentication issue was discovered in Hikvision devices ​ The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users ​ This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information # inj3ction

修复了源项目的一个bug,若能正常使用使用源项目即可

CVE_2017_7921_EXP 源项目地址:githubcom/JrDw0/CVE-2017-7921-EXP 删除了几行导致bug的代码,若能正常使用请使用源项目 使用 pip3 install requirementstxt python3 \CVE_2017_7921_EXPpy --target=1txt run Python39 Windows 11 测试通过 多线程改炸了,有需要可以回滚使用

修复了源项目的一个bug,若能正常使用使用源项目即可

CVE_2017_7921_EXP 源项目地址:githubcom/JrDw0/CVE-2017-7921-EXP 删除了几行导致bug的代码,若能正常使用请使用源项目 使用 pip3 install requirementstxt python3 \CVE_2017_7921_EXPpy --target=1txt run Python39 Windows 11 测试通过 多线程改炸了,有需要可以回滚使用

A PoC exploit for CVE-2017-7921 - Hikvision Camera Series Improper Authentication Vulnerability.

CVE-2017-7921 - Hikvision Camera Series Improper Authentication Vulnerability A security flaw identified as CVE-2017-7921, which affects various models of Hikvision cameras The vulnerability was discovered in the DS-2CD2xx2F-I Series (V520 build 140721 to V540 build 160530), DS-2CD2xx0F-I Series (V520 build 140721 to V540 Build 160401), DS-2CD2xx2FWD Series (V531 bui

Hikvision camera CVE-2017-7921-EXP

CVE-2017-7921 Exploit An Improper Authentication issue was discovered in Hikvision devices ​ The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users ​ This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information ​ seclistsorg/f

Hikvision IP camera access bypass exploit, developed by golang.

Hikvision bypass exploit Requirements githubcom/levigross/grequests githubcom/msterzhang/gpool golangorg/x/net githubcom/go-vgo/robotgo Build git clone githubcom/MisakaMikato/cve-2017-7921-golanggit cd cve-2017-7921-golang/src/cve-2017-7921-golang go build Usage cve-2017-7921 [-e] [-b] [--password password] [-t target] [

CVE-2017-7921 exploit. Allows admin password retrieval and automatic snapshot download.

CVE-2017-7921 exploit This script allows interaction with a CVE-2017-7921 vulnerable camera to perform the following operations: Download and decrypt a configuration file, containing the camera's admin's password Continuously download images every second Convert a series of downloaded images into a video Requirements Python 3x Packages listed in requirementstx

a collection of cyberchef recipes i've written or cobbled together

cyberchef-recipes a collection of cyberchef recipes i've written or cobbled together Hikvision IP Camera Auth Bypass - Configuration File Decryption CVE-2017-7921 cybercheforg/#recipe=AES_Decrypt(%7B'option':'Hex','string':'279977f62f6cfd2d91cd75b889ce0c9a'%7D,%7B'option':'Hex','string':'

批量扫描破解海康威视、大华等摄像头的常见漏洞。

CameraHack 批量扫描破解海康威视、大华等摄像头的常见漏洞、弱密码 海康威视 RTSP 弱密码 # 主码流 rtsp://admin:12345@IP:554/h264/ch1/main/av_stream rtsp://admin:12345@IP:554/MPEG-4/ch1/main/av_stream # 子码流 rtsp://admin:12345@IP/mpeg4/ch1/sub/av_stream rtsp://admin:12345@IP/h264/ch1/sub/av_stream CVE-2

DecryptTools-综合解密

DecryptTools综合解密 一款针对加解密综合利用后渗透工具 👮🏻‍♀️ 免责声明 由于传播、利用DecryptTools综合解密工具提供的功能而造成的任何直接或者间接的后果及损失,均由使用者本人负责,本人不为此承担任何责任。 前言 为什么会写这一款综合加解密工具,因为在很多比赛如果

cve-2017-7921-Mass-Exploit Mass Config Download python3 downloadpy -i ip -s -v Mass Snapshot Taker python3 snapshotpy -i ip -s -v Config Decrypt python3 decryptpy file-name Default port is 80 Change port in both code downloadpy , snapshotpy file contain only ip Fofa Dork "App-webs" && server=="App-webs/" && port="80&

Python script get image from Hikvision camera with CVE-2017-7921 vulnerability

AnonHik Python script to get image from Hikvision camera with CVE-2017-7921 vulnerability Demo:

hikvision_CVE-2017-7921_auth_bypass_config_decryptor This python file will decrypt the configurationFile used by hikvision cameras vulnerable to CVE-2017-7921 wwwcheckpointcom/defense/advisories/public/2017/cpai-2017-0876html/ Description Hikvision IP Cameras Authentication Bypass (CVE-2017-7921) Basically, hikvision cameras that are vulnerable to the CVE listed abo

This python file will decrypt the configurationFile used by hikvision cameras vulnerable to CVE-2017-7921.

hikvision_CVE-2017-7921_auth_bypass_config_decryptor This python file will decrypt the configurationFile used by hikvision cameras vulnerable to CVE-2017-7921 wwwcheckpointcom/defense/advisories/public/2017/cpai-2017-0876html/ Description Hikvision IP Cameras Authentication Bypass (CVE-2017-7921) Basically, hikvision cameras that are vulnerable to the CVE listed abo

hikexpl: Exploiting Hikvision Backdoor (CVE-2017-7921) Overview This Python script, named hikexpl, is designed as a poc to demonstrate the the Hikvision backdoor vulnerability, CVE-2017-7921 The focus of this script is not only on exploiting the vulnerability but also on writing clean, readable, and maintainable Python code Features Scanning: Utilizes the Shodan API to scan