{"uuid": "4c4176c9-f9bf-4287-bdde-3a3a2e76b0dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2017-7921", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/hikvision_unauth_pwd_reset_cve_2017_7921.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"Monte Crypto\", \"h00die-gr3y \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"Many Hikvision IP cameras contain improper authentication logic which allows unauthenticated impersonation of any configured user account.\\n          The vulnerability has been present in Hikvision products since 2014. In addition to Hikvision-branded devices, it\\n          affects many white-labeled camera products sold under a variety of brand names.\\n\\n          Hundreds of thousands of vulnerable devices are still exposed to the Internet at the time\\n          of publishing (shodan search: '\\\"App-webs\\\" \\\"200 OK\\\"'). Some of these devices can never be patched due to to the\\n          vendor preventing users from upgrading the installed firmware on the affected device.\\n\\n          This module utilizes the bug in the authentication logic to perform an unauthenticated password change of any user account on\\n          a vulnerable Hikvision IP Camera. This can then be utilized to gain full administrative access to the affected device.\", \"disclosure_date\": \"2017-09-23\", \"fullname\": \"auxiliary/admin/http/hikvision_unauth_pwd_reset_cve_2017_7921\", \"is_install_path\": true, \"mod_time\": \"2026-04-15 11:57:01 +0000\", \"name\": \"Hikvision IP Camera Unauthenticated Password Change Via Improper Authentication Logic\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/admin/http/hikvision_unauth_pwd_reset_cve_2017_7921.rb\", \"platform\": \"\", \"post_auth\": true, \"rank\": 300, \"ref_name\": \"admin/http/hikvision_unauth_pwd_reset_cve_2017_7921\", \"references\": [\"CVE-2017-7921\", \"PACKETSTORM-144097\", \"URL-https://ipvm.com/reports/hik-exploit\", \"URL-https://attackerkb.com/topics/PlLehGSmxT/cve-2017-7921\", \"URL-https://seclists.org/fulldisclosure/2017/Sep/23\"], \"rport\": 80, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:46:45.603197Z"}