CISA KEV: Hikvision Camera Auth Bypass (CVE-2017-7921) & Rockwell Logix Credential Exposure (CVE-2021-22681) — Active Exploitation

CISA KEV: Hikvision Camera Auth Bypass (CVE-2017-7921) & (TL-2026-0181) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-03-06. It has no confirmed attribution, affects Hikvision DS-2CD2xx2F-I Series IP Camera, references 2 CVEs (CVE-2017-7921, CVE-2021-22681), maps to 16 MITRE ATT&CK techniques (T0831, T0875, T0879), and is covered by 9 detection rules and 15 indicators of compromise.

Key facts for TL-2026-0181

Threat ID
TL-2026-0181
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-03-06
Last reviewed
2026-03-06
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
government, critical-infrastructure, manufacturing, energy, water-wastewater, transportation, healthcare, defense, financial, commercial-facilities
Target regions
Global, North America, Europe, Asia-Pacific, Middle East
Detection rules
9
Indicators of compromise
15

Malware and tooling in CISA KEV: Hikvision Camera Auth Bypass (CVE-2017-7921) &

Malware and tooling: ZeroBot, CVE-2017-7921-EXPLOIT, hikvision_CVE-2017-7921_auth_bypass_config_decryptor

CISA added two critical ICS/IoT vulnerabilities to the Known Exploited Vulnerabilities catalog on 2026-03-05. CVE-2017-7921 (CVSS 9.8) is an improper authentication flaw in Hikvision IP cameras allowing unauthenticated access to configuration files, credentials, and live snapshots via a hardcoded auth bypass. CVE-2021-22681 (CVSS 10.0) is an insufficiently protected credentials vulnerability in Rockwell Automation Logix controllers where a hardcoded cryptographic key enables unauthenticated attackers to impersonate engineering workstations and upload malicious PLC code. Both are confirmed actively exploited with FCEB remediation due by 2026-03-26.

How CISA KEV: Hikvision Camera Auth Bypass (CVE-2017-7921) & works

This threat encompasses two critical vulnerabilities added to the CISA Known Exploited Vulnerabilities (KEV) catalog on March 5, 2026, both carrying CVSS scores of 9.8-10.0 and posing severe risks to IoT surveillance and industrial control system (ICS) environments.

**CVE-2017-7921 — Hikvision IP Camera Improper Authentication**

CVE-2017-7921 is an improper authentication vulnerability (CWE-287) affecting multiple Hikvision IP camera series with firmware versions V5.0.9 through V5.4.5. The flaw resides in the camera's web interface authentication mechanism, which fails to properly validate user credentials for sensitive API endpoints. An unauthenticated remote attacker can access privileged endpoints by appending the query parameter `?auth=YWRtaW46MTEK` (base64 for 'admin:11') to HTTP requests. This grants administrative access without requiring valid credentials.

The most commonly exploited endpoints include: - `/System/deviceInfo?auth=YWRtaW46MTEK` — Device information disclosure - `/System/configurationFile?auth=YWRtaW46MTEK` — Full configuration file download (encrypted with weak static key) - `/Security/users?auth=YWRtaW46MTEK` — User credential enumeration - `/security/users/1?auth=YWRtaW46MTEK` — Admin user details - `/onvif-http/snapshot?auth=YWRtaW46MTEK` — Live camera snapshot capture

The downloaded configuration files use weak encryption with a static key, allowing attackers to decrypt and harvest plaintext credentials. SANS Internet Storm Center documented over 12,000 exploit attempts against honeypots between 2017 and 2025, with the most prevalent target being the configurationFile endpoint (6,720 reports). The Go-based malware Zerobot exploited this vulnerability in 2022 to recruit IoT devices into botnets. Many devices remain vulnerable due to third-party rebranding, limited user awareness, and the widespread deployment of Hikvision cameras globally.

**CVE-2021-22681 — Rockwell Automation Logix Controllers Insufficiently Protected Credentials**

CVE-2021-22681 is a critical insufficiently protected credentials vulnerability (CWE-522) affecting Rockwell Automation's Studio 5000 Logix Designer, RSLogix 5000, and the entire Logix controller family. The vulnerability received a CVSS v3 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) — the maximum possible severity.

The core issue involves a hardcoded cryptographic key used by Studio 5000 Logix Designer to verify communications between engineering workstations and Logix controllers via the Common Industrial Protocol (CIP). This key digitally signs all communication with the PLCs, and controllers verify the signature before authorizing operations. However, the key is insufficiently protected and can be extracted, allowing an unauthenticated attacker on the network to forge valid signatures, bypass authentication, and impersonate a legitimate engineering workstation.

Successful exploitation enables an attacker to: - Upload malicious ladder logic or application code to PLCs - Download sensitive process data and intellectual property - Install unauthorized firmware modifications - Directly manipulate manufacturing processes and safety systems - Potentially cause physical damage to industrial equipment

The vulnerability was independently discovered by researchers at Soonchunhyang University (South Korea), Kaspersky ICS CERT, and Claroty Team82. Critically, Rockwell Automation has determined that this vulnerability cannot be mitigated with a software patch. Mitigation requires deploying CIP Security (TLS/DTLS-based secure communications) and placing controllers in Run mode to prevent unauthorized program changes.

Affected controllers are widely deployed across critical infrastructure sectors including manufacturing, energy, water/wastewater treatment, and transportation. The combination of network-accessible attack vector, no authentication required, and the inability to patch makes this vulnerability exceptionally dangerous for ICS environments.

---

**Revalidated on 2026-03-12**

Revalidation one week after the CISA KEV addition confirms both vulnerabilities remain under active exploitation with the FCEB remediation deadline now 14 days away (March 26, 2026). Several significant intelligence developments have emerged since the original threat publication.

**HiatusRAT Campaign Targeting Hikvision (FBI PIN, December 2024):** An FBI Private Industry Notification published December 16, 2024, revealed that HiatusRAT threat actors conducted coordinated scanning campaigns in March 2024 specifically targeting Hikvision and Xiongmai IoT devices across Five Eyes nations. The actors used Ingram (an open-source webcam-scanning tool) and Medusa (a brute-force authentication cracker) to target devices vulnerable to CVE-2017-7921 among six CVEs. This campaign predates the CISA KEV listing by nearly two years and demonstrates sustained nation-state-level interest in exploiting legacy Hikvision authentication bypasses for intelligence collection and network pivoting.

**Canada Hikvision Ban (June 2025):** The Canadian government ordered Hikvision Canada to cease all operations on June 27, 2025, under the Investment Canada Act -- the most extensive action by any Western government against the firm. Hikvision's legal challenge was dismissed by Federal Court in September 2025. This geopolitical escalation, combined with the existing NDAA Section 889 federal procurement ban and FCC Covered Equipment List designation, underscores the converging regulatory and threat landscape around Hikvision infrastructure.

**Rockwell Advisory Update -- First Exploitation Acknowledgment (March 5, 2026):** Rockwell Automation updated its own CVE-2021-22681 advisory on the same day as the CISA KEV addition to acknowledge in-the-wild exploitation for the first time. Notably, five years after disclosure, Rockwell has still not issued a patch because the vulnerability represents a fundamental design flaw in the cryptographic key verification used between Studio 5000 Logix Designer and Logix controllers. The key cannot be rotated or replaced without redesigning the authentication protocol. With nearly 6,000 internet-exposed Rockwell devices visible on Shodan, organizations must rely entirely on network segmentation (blocking TCP 44818 from external traffic), CIP Security with TLS/DTLS, VPN-only remote access, and physical mode-switch hardening (setting controllers to Run position).

**NDAA Section 889 Paradox:** Chemical facility security analysts noted that NDAA Section 889 (PL 115-232, 2019) already prohibited federal agencies from procuring Hikvision equipment, raising questions about residual FCEB exposure. Any remaining Hikvision devices in federal environments represent both a compliance violation and an active security risk.

**No Ransomware Attribution Yet:** While both CVEs are confirmed actively exploited, no public evidence currently links exploitation to specific ransomware operations. However, the Zerobot botnet (2022) and HiatusRAT (2024) campaigns demonstrate that IoT botnet operators and state-aligned actors are the primary exploitation vectors for CVE-2017-7921.

MITRE ATT&CK techniques used in TL-2026-0181

Impact

T0831 Manipulation of Control; T0879 Damage to Property

Execution

T0875 Change Program State

Persistence

T0889 Modify Program

collection

T1005 Data from Local System; T1125 Video Capture

exfiltration

T1041 Exfiltration Over C2 Channel

defense-evasion

T1078 Valid Accounts; T1684.001 Impersonation

discovery

T1082 System Information Discovery; T1087 Account Discovery

persistence

T1133 External Remote Services

initial-access

T1190 Exploit Public-Facing Application

lateral-movement

T1210 Exploitation of Remote Services

credential-access

T1552 Unsecured Credentials; T1555 Credentials from Password Stores

Affected products and versions in CISA KEV: Hikvision Camera Auth Bypass (CVE-2017-7921) &

  • Hikvision — DS-2CD2xx2F-I Series IP Camera
    Vulnerable versions: V5.2.0 build 140721 to V5.4.0 build 160530
    Fixed in: Firmware update June 2017+
  • Hikvision — DS-2CD2xx0F-I Series IP Camera
    Vulnerable versions: V5.2.0 build 140721 to V5.4.0 build 160401
    Fixed in: Firmware update June 2017+
  • Hikvision — DS-2CD2xx2FWD Series IP Camera
    Vulnerable versions: V5.3.1 build 150410 to V5.4.5 build 170124
    Fixed in: Firmware update June 2017+
  • Hikvision — DS-2CD4x2xFWD Series IP Camera
    Vulnerable versions: V5.2.0 build 140721 to V5.4.0 build 160414
    Fixed in: Firmware update June 2017+
  • Hikvision — DS-2CD4xx5 Series IP Camera
    Vulnerable versions: V5.2.0 build 140721 to V5.4.0 build 160421
    Fixed in: Firmware update June 2017+
  • Hikvision — DS-2DFx Series IP Camera
    Vulnerable versions: V5.2.0 build 140805 to V5.4.5 build 160928
    Fixed in: Firmware update June 2017+
  • Hikvision — DS-2CD63xx Series IP Camera
    Vulnerable versions: V5.0.9 build 140305 to V5.3.5 build 160106
    Fixed in: Firmware update June 2017+
  • Rockwell Automation — CompactLogix 1768/1769/5370/5380/5480 Controllers
    Vulnerable versions: All versions
    Fixed in: No patch — deploy CIP Security
  • Rockwell Automation — ControlLogix 5550/5560/5570/5580 Controllers
    Vulnerable versions: All versions
    Fixed in: No patch — deploy CIP Security
  • Rockwell Automation — DriveLogix 5560/5730/1794-L34 Controllers
    Vulnerable versions: All versions
    Fixed in: No patch — deploy CIP Security

Remediation for CISA KEV: Hikvision Camera Auth Bypass (CVE-2017-7921) &

Patches

  • Hikvision: Firmware updates available since June 2017 for all affected camera series
  • Rockwell: No patch available — mitigate with CIP Security and Run mode deployment

Immediate actions

  • Audit all Hikvision camera deployments and identify devices running firmware V5.0.9 through V5.4.5
  • Isolate all affected Hikvision cameras from public internet immediately
  • Place all Rockwell Logix controllers in Run mode to prevent unauthorized program changes
  • Block TCP port 44818 (CIP) traffic from outside ICS zones at perimeter firewalls
  • Monitor Hikvision camera logs for requests containing auth=YWRtaW46MTEK parameter
  • Review Rockwell controller change logs for unauthorized modifications

Workarounds

  • Hikvision: Restrict access via firewall rules, disable public-facing web interface
  • Rockwell: Use 1756-EN4TR EtherNet/IP Module with CIP Security capabilities
  • Rockwell: Deploy FactoryTalk Security Platform v2.10+ for enhanced authentication
  • Both: Implement strict network segmentation between OT/IoT and corporate networks

Longer-term hardening

  • Update all Hikvision cameras to latest firmware versions (patches available since 2017)
  • Deploy CIP Security with TLS/DTLS-based secure communications for Rockwell controllers
  • Implement network segmentation isolating surveillance and ICS networks from corporate IT
  • Deploy IDS/IPS rules to detect CVE-2017-7921 exploit attempts
  • Implement FactoryTalk AssetCentre for continuous monitoring of PLC program changes
  • Replace default credentials on all Hikvision devices with complex passwords
  • Deploy VPN-only access for remote camera and PLC management

CVEs associated with CISA KEV: Hikvision Camera Auth Bypass (CVE-2017-7921) &

CVE-2017-7921, CVE-2021-22681

Weaknesses (CWE) in CISA KEV: Hikvision Camera Auth Bypass (CVE-2017-7921) &

CWE-287, CWE-522

Timeline of CISA KEV: Hikvision Camera Auth Bypass (CVE-2017-7921) &

  • CVE-2017-7921 publicly disclosed — Hikvision IP camera improper authentication vulnerability affecting firmware V5.0.9 through V5.4.5
  • Hikvision releases firmware updates patching CVE-2017-7921 for all affected camera series
  • First exploit attempts observed against Hikvision cameras in the wild according to SANS ISC honeypot data
  • Claroty Team82 privately discloses CVE-2021-22681 cryptographic key vulnerability to Rockwell Automation
  • CISA publishes ICS Advisory ICSA-21-056-03 for Rockwell Automation Logix Controllers (CVE-2021-22681, CVSS 10.0)
  • CVE-2021-22681 publicly disclosed — Rockwell confirms vulnerability cannot be patched, recommends CIP Security deployment
  • Zerobot (Go-based malware) observed exploiting CVE-2017-7921 to recruit Hikvision cameras into IoT botnet infrastructure
  • HiatusRAT actors conduct scanning campaign targeting Hikvision and Xiongmai IoT devices across Five Eyes nations (US, AU, CA, NZ, UK) using Ingram webcam-scanner and Medusa brute-force tool, specifically targeting CVE-2017-7921 among six CVEs [Source: https://www.ic3.gov/CSA/2024/241216.pdf]
  • FBI publishes Private Industry Notification (PIN) warning that HiatusRAT actors are targeting web cameras and DVRs including Hikvision devices vulnerable to CVE-2017-7921 [Source: https://thehackernews.com/2024/12/cisa-and-fbi-raise-alerts-on-exploited.html]
  • FortiGuard documents active exploitation attempts against Hikvision cameras via CVE-2017-7921 authentication bypass signatures [Source: https://fortiguard.fortinet.com/encyclopedia/ips/57024]
  • Canadian government orders Hikvision Canada to cease all operations citing national security concerns under the Investment Canada Act; most extensive Western government action against the firm to date [Source: https://www.cbc.ca/news/politics/hikvision-ordered-cease-canadian-operations-security-concerns-1.7573584]
  • Hikvision''s legal challenge to Canada''s shutdown order dismissed by Federal Court, ban remains in effect [Source: https://www.nortonrosefulbright.com/en/knowledge/publications/c1c86f5d/hikvision-challenges-governments-national-security-order-under]
  • SANS Internet Storm Center reports over 12,000 exploit attempts against Hikvision cameras including /System/configurationFile endpoint (6,720 reports)
  • Rockwell Automation updates its CVE-2021-22681 advisory to acknowledge in-the-wild exploitation for the first time, five years after initial disclosure; no attack details shared publicly [Source: https://www.securityweek.com/rockwell-vulnerability-allowing-remote-ics-hacking-exploited-in-attacks/]
  • CISA adds CVE-2017-7921 and CVE-2021-22681 to Known Exploited Vulnerabilities catalog with FCEB remediation deadline of 2026-03-26
  • Chemical facility security analysts note NDAA Section 889 already prohibited federal Hikvision procurement since 2019, questioning residual FCEB exposure requiring KEV remediation [Source: https://chemical-facility-security-news.blogspot.com/2026/03/cisa-adds-hikvision-vulnerability-kev.html]
  • The Hacker News and multiple security outlets report on CISA KEV additions, highlighting ongoing active exploitation of both vulnerabilities
  • Revalidation confirms both CVEs remain actively exploited with FCEB remediation deadline of March 26, 2026 in 14 days; Shodan shows ~6,000 internet-exposed Rockwell devices; Hikvision exploitation volume continues via automated scanning campaigns [Source: https://vulert.com/blog/hikvision-rockwell-cve-2017-7921-cve-2021-22681/]
  • As of 2026-05-29, both CVEs remain CISA KEV-listed (added 2026-03-05) and actively exploited, with CVE-2021-22681 unable to be fully patched (Rockwell advises mitigations only) and CVE-2017-7921 still exposed on legacy Hikvision cameras with public Metasploit PoCs. The record's PATCHED status is inaccurate; no evidence the exploitation campaign has concluded.

Sources cited for CISA KEV: Hikvision Camera Auth Bypass (CVE-2017-7921) &

More in vulnerability

Detection coverage for TL-2026-0181

As of 2026-03-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0181 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats