# CISA KEV: Hikvision Camera Auth Bypass (CVE-2017-7921) & Rockwell Logix Credential Exposure (CVE-2021-22681) — Active Exploitation

> CISA added two critical ICS/IoT vulnerabilities to the Known Exploited Vulnerabilities catalog on 2026-03-05. CVE-2017-7921 (CVSS 9.8) is an improper authentication flaw in Hikvision IP cameras allowing unauthenticated access to configuration files, credentials, and live snapshots via a hardcoded auth bypass. CVE-2021-22681 (CVSS 10.0) is an insufficiently protected credentials vulnerability in Rockwell Automation Logix controllers where a hardcoded cryptographic key enables unauthenticated attackers to impersonate engineering workstations and upload malicious PLC code. Both are confirmed actively exploited with FCEB remediation due by 2026-03-26.

- **Published:** 2026-03-06T11:04:11Z
- **Last reviewed:** 2026-03-06T11:04:11Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0181
- **ID:** TL-2026-0181
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2017-7921, CVE-2021-22681

## Description

This threat encompasses two critical vulnerabilities added to the CISA Known Exploited Vulnerabilities (KEV) catalog on March 5, 2026, both carrying CVSS scores of 9.8-10.0 and posing severe risks to IoT surveillance and industrial control system (ICS) environments.

**CVE-2017-7921 — Hikvision IP Camera Improper Authentication**

CVE-2017-7921 is an improper authentication vulnerability (CWE-287) affecting multiple Hikvision IP camera series with firmware versions V5.0.9 through V5.4.5. The flaw resides in the camera's web interface authentication mechanism, which fails to properly validate user credentials for sensitive API endpoints. An unauthenticated remote attacker can access privileged endpoints by appending the query parameter `?auth=YWRtaW46MTEK` (base64 for 'admin:11') to HTTP requests. This grants administrative access without requiring valid credentials.

The most commonly exploited endpoints include:
- `/System/deviceInfo?auth=YWRtaW46MTEK` — Device information disclosure
- `/System/configurationFile?auth=YWRtaW46MTEK` — Full configuration file download (encrypted with weak static key)
- `/Security/users?auth=YWRtaW46MTEK` — User credential enumeration
- `/security/users/1?auth=YWRtaW46MTEK` — Admin user details
- `/onvif-http/snapshot?auth=YWRtaW46MTEK` — Live camera snapshot capture

The downloaded configuration files use weak encryption with a static key, allowing attackers to decrypt and harvest plaintext credentials. SANS Internet Storm Center documented over 12,000 exploit attempts against honeypots between 2017 and 2025, with the most prevalent target being the configurationFile endpoint (6,720 reports). The Go-based malware Zerobot exploited this vulnerability in 2022 to recruit IoT devices into botnets. Many devices remain vulnerable due to third-party rebranding, limited user awareness, and the widespread deployment of Hikvision cameras globally.

**CVE-2021-22681 — Rockwell Automation Logix Controllers Insufficiently Protected Credentials**

CVE-2021-22681 is a critical insufficiently protected credentials vulnerability (CWE-522) affecting Rockwell Automation's Studio 5000 Logix Designer, RSLogix 5000, and the entire Logix controller family. The vulnerability received a CVSS v3 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) — the maximum possible severity.

The core issue involves a hardcoded cryptographic key used by Studio 5000 Logix Designer to verify communications between engineering workstations and Logix controllers via the Common Industrial Protocol (CIP). This key digitally signs all communication with the PLCs, and controllers verify the signature before authorizing operations. However, the key is insufficiently protected and can be extracted, allowing an unauthenticated attacker on the network to forge valid signatures, bypass authentication, and impersonate a legitimate engineering workstation.

Successful exploitation enables an attacker to:
- Upload malicious ladder logic or application code to PLCs
- Download sensitive process data and intellectual property
- Install unauthorized firmware modifications
- Directly manipulate manufacturing processes and safety systems
- Potentially cause physical damage to industrial equipment

The vulnerability was independently discovered by researchers at Soonchunhyang University (South Korea), Kaspersky ICS CERT, and Claroty Team82. Critically, Rockwell Automation has determined that this vulnerability cannot be mitigated with a software patch. Mitigation requires deploying CIP Security (TLS/DTLS-based secure communications) and placing controllers in Run mode to prevent unauthorized program changes.

Affected controllers are widely deployed across critical infrastructure sectors including manufacturing, energy, water/wastewater treatment, and transportation. The combination of network-accessible attack vector, no authentication required, and the inability to patch makes this vulnerability exceptionally dangerous for ICS environments.

---

**Revalidated on 2026-03-12**

Revalidation one week after the CISA KEV addition confirms both vulnerabilities remain under active exploitation with the FCEB remediation deadline now 14 days away (March 26, 2026). Several significant intelligence developments have emerged since the original threat publication.

**HiatusRAT Campaign Targeting Hikvision (FBI PIN, December 2024):** An FBI Private Industry Notification published December 16, 2024, revealed that HiatusRAT threat actors conducted coordinated scanning campaigns in March 2024 specifically targeting Hikvision and Xiongmai IoT devices across Five Eyes nations. The actors used Ingram (an open-source webcam-scanning tool) and Medusa (a brute-force authentication cracker) to target devices vulnerable to CVE-2017-7921 among six CVEs. This campaign predates the CISA KEV listing by nearly two years and demonstrates sustained nation-state-level interest in exploiting legacy Hikvision authentication bypasses for intelligence collection and network pivoting.

**Canada Hikvision Ban (June 2025):** The Canadian government ordered Hikvision Canada to cease all operations on June 27, 2025, under the Investment Canada Act -- the most extensive action by any Western government against the firm. Hikvision's legal challenge was dismissed by Federal Court in September 2025. This geopolitical escalation, combined with the existing NDAA Section 889 federal procurement ban and FCC Covered Equipment List designation, underscores the converging regulatory and threat landscape around Hikvision infrastructure.

**Rockwell Advisory Update -- First Exploitation Acknowledgment (March 5, 2026):** Rockwell Automation updated its own CVE-2021-22681 advisory on the same day as the CISA KEV addition to acknowledge in-the-wild exploitation for the first time. Notably, five years after disclosure, Rockwell has still not issued a patch because the vulnerability represents a fundamental design flaw in the cryptographic key verification used between Studio 5000 Logix Designer and Logix controllers. The key cannot be rotated or replaced without redesigning the authentication protocol. With nearly 6,000 internet-exposed Rockwell devices visible on Shodan, organizations must rely entirely on network segmentation (blocking TCP 44818 from external traffic), CIP Security with TLS/DTLS, VPN-only remote access, and physical mode-switch hardening (setting controllers to Run position).

**NDAA Section 889 Paradox:** Chemical facility security analysts noted that NDAA Section 889 (PL 115-232, 2019) already prohibited federal agencies from procuring Hikvision equipment, raising questions about residual FCEB exposure. Any remaining Hikvision devices in federal environments represent both a compliance violation and an active security risk.

**No Ransomware Attribution Yet:** While both CVEs are confirmed actively exploited, no public evidence currently links exploitation to specific ransomware operations. However, the Zerobot botnet (2022) and HiatusRAT (2024) campaigns demonstrate that IoT botnet operators and state-aligned actors are the primary exploitation vectors for CVE-2017-7921.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1552 Unsecured Credentials
- T1555 Credentials from Password Stores
- T1078 Valid Accounts
- T1684.001 Impersonation
- T1082 System Information Discovery
- T1087 Account Discovery
- T1005 Data from Local System
- T1125 Video Capture
- T1210 Exploitation of Remote Services
- T1041 Exfiltration Over C2 Channel
- T0831 Manipulation of Control
- T0879 Damage to Property
- T0875 Change Program State
- T0889 Modify Program

## Sources

- [CISA KEV Catalog — CVE-2017-7921 & CVE-2021-22681 Added](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [CISA Adds Five Known Exploited Vulnerabilities to Catalog (March 5, 2026)](https://www.cisa.gov/news-events/alerts/2026/03/05/cisa-adds-five-known-exploited-vulnerabilities-catalog)
- [CISA ICS Advisory ICSA-21-056-03 — Rockwell Automation Logix Controllers](https://www.cisa.gov/news-events/ics-advisories/icsa-21-056-03)
- [NVD — CVE-2017-7921 (Hikvision Improper Authentication)](https://nvd.nist.gov/vuln/detail/CVE-2017-7921)
- [NVD — CVE-2021-22681 (Rockwell Logix Auth Bypass)](https://nvd.nist.gov/vuln/detail/CVE-2021-22681)
- [Hikvision Security Advisory — Privilege Escalation Vulnerability](https://www.hikvision.com/us-en/support/document-center/special-notices/privilege-escalating-vulnerability-in-certain-hikvision-ip-cameras/)
- [Rockwell Automation Support — CVE-2021-22681 Authentication Bypass](https://support.rockwellautomation.com/app/answers/answer_view/a_id/1130301/)
- [Claroty Team82 — Critical Authentication Bypass in Rockwell Software](https://claroty.com/team82/research/critical-authentication-bypass-in-rockwell-software)
- [The Hacker News — Hikvision and Rockwell CVSS 9.8 Flaws Added to CISA KEV](https://thehackernews.com/2026/03/hikvision-and-rockwell-automation-cvss.html)
- [SANS ISC — Exploit Attempts Against Older Hikvision Camera Vulnerability](https://isc.sans.edu/diary/Exploit+Attempts+Against+Older+Hikvision+Camera+Vulnerability/32316/)
- [Field Effect — Legacy Hikvision Camera Vulnerability Resurfaces](https://fieldeffect.com/blog/legacy-hikvision-vulnerability-resurfaces)
- [CVE-2017-7921 PoC Exploit — K3ysTr0K3R](https://github.com/K3ysTr0K3R/CVE-2017-7921-EXPLOIT)
- [Hikvision Config Decryptor — chrisjd20](https://github.com/chrisjd20/hikvision_CVE-2017-7921_auth_bypass_config_decryptor)
- [Exploit-DB 44328 — Hikvision Access Control Bypass](https://www.exploit-db.com/exploits/44328)
- [Kaspersky ICS CERT — KLCERT-17-029 Rockwell Authentication Bypass](https://ics-cert.kaspersky.com/vulnerabilities/klcert-17-029-authentication-bypass-in-rockwell-automation-logix-controllers/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0181