CISA KEV: Hikvision Camera Auth Bypass (CVE-2017-7921) & Rockwell Logix Credential Exposure (CVE-2021-22681) — Active Exploitation — Threadlinqs Intelligence
As of 2026-05-30, CISA KEV: Hikvision Camera Auth Bypass (CVE-2017-7921) & Rockwell Logix Credential Exposure (CVE-2021-22681) — Active Exploitation is a critical-severity vulnerability threat attributed to a N/A-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 15 indicators of compromise.
Threat ID: TL-2026-0181 · Severity: CRITICAL · CVSS: 9.8 · Status: ACTIVE · Category: VULNERABILITY
Attribution: N/A · UNKNOWN
CISA added two critical ICS/IoT vulnerabilities to the Known Exploited Vulnerabilities catalog on 2026-03-05. CVE-2017-7921 (CVSS 9.8) is an improper authentication flaw in Hikvision IP cameras
This threat encompasses two critical vulnerabilities added to the CISA Known Exploited Vulnerabilities (KEV) catalog on March 5, 2026, both carrying CVSS scores of 9.8-10.0 and posing severe risks to IoT surveillance and industrial control system (ICS) environments.
**CVE-2017-7921 — Hikvision IP Camera Improper Authentication**
CVE-2017-7921 is an improper authentication vulnerability (CWE-287) affecting multiple Hikvision IP camera series with firmware versions V5.0.9 through V5.4.5. The flaw resides in the camera's web interface authentication mechanism, which fails to properly validate user credentials for sensitive API endpoints. An unauthenticated remote attacker can access privileged endpoints by appending the query parameter `?auth=YWRtaW46MTEK` (base64 for 'admin:11') to HTTP requests. This grants administrative access without requiring valid credentials.
The most commonly exploited endpoints include:
- `/System/deviceInfo?auth=YWRtaW46MTEK` — Device information disclosure
- `/System/configurationFile?auth=YWRtaW46MTEK` — Full configuration file download (encrypted with weak static key)
- `/Security/users?auth=YWRtaW46MTEK` — User credential enumeration
- `/security/users/1?auth=YWRtaW46MTEK` — Admin user details
- `/onvif-http/snapshot?auth=YWRtaW46MTEK` — Live camera snapshot capture
The downloaded configuration files use weak encryption with a static key, allowing attackers to decrypt and harvest plaintext credentials. SANS Internet Storm Center documented over 12,000 exploit attempts against honeypots between 2017 and 2025, with the most prevalent target being the configurationFile endpoint (6,720 reports). The Go-based malware Zerobot exploited this vulnerability in 2022 to recruit IoT devices into botnets. Many devices remain vulnerable due to third-party rebranding, limited user awareness, and the widespread deployment of Hikvision cameras globally.
**CVE-2021-22681 — Rockwell Automation Logix Controllers Insufficiently Protected Credentials**
CVE-2021-22681 is a critical insufficiently protected credentials vulnerability (CWE-522) affecting Rockwell Automation's Studio 5000 Logix Designer, RSLogix 5000, and the entire Logix controller family. The vulnerability received a CVSS v3 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) — the maximum possible severity.
The core issue involves a hardcoded cryptographic key used by Studio 5000 Logix Designer to verify communications between engineering workstations and Logix controllers via the Common Industrial Protocol (CIP). This key digitally signs all communication with the PLCs, and controllers verify the signature before authorizing operations. However, the key is insufficiently protected and can be extracted, allowing an unauthenticated attacker on the network to forge valid signatures, bypass authentication, and impersonate a legitimate engineering workstation.
Successful exploitation enables an attacker to:
- Upload malicious ladder logic or application code to PLCs
- Download sensitive process data and intellectual property
- Install unauthorized firmware modifications
- Directly manipulate manufacturing processes and safety systems
- Potentially cause physical damage to industrial equipment
The vulnerability was independently discovered by researchers at Soonchunhyang University (South Korea), Kaspersky ICS CERT, and Claroty Team82. Critically, Rockwell Automation has determined that this vulnerability cannot be mitigated with a software patch. Mitigation requires deploying CIP Security (TLS/DTLS-based secure communications) and placing controllers in Run mode to prevent unauthorized program changes.
Affected controllers are widely deployed across critical infrastructure sectors including manufacturing, energy, water/wastewater treatment, and transportation. The combination of network-accessible attack vector, no authentication required, and the inability to patch makes this vulnerability exceptionally dangerous for ICS environments.
---
**
Weaknesses (CWE)
CWE-287, CWE-522
Target sectors: government, critical-infrastructure, manufacturing, energy, water-wastewater, transportation, healthcare, defense, financial, commercial-facilities
Target regions: Global, North America, Europe, Asia-Pacific, Middle East
Detections & IOCs
As of 2026-07-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 15 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2017-7921, CVE-2021-22681, T1190, T1133, T1552, T1555, T1078, T1656, T1078, T1082, T1087, T1005