CVE-2017-7921 Information

Description

An Improper Authentication issue was discovered in Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530 DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401 DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125 DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414 DS-2CD4xx5 Series V5.2.0 build 140721 to V5.4.0 Build 160421 DS-2DFx Series V5.2.0 build 140805 to V5.4.5 Build 160928 and DS-2CD63xx Series V5.0.9 build 140305 to V5.3.5 Build 160106 devices. The improper authentication vulnerability occurs when an application does not adequately or correctly authenticate users. This may allow a malicious user to escalate his or her privileges on the system and gain access to sensitive information.

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Reference

http://www.hikvision.com/us/about_10805.html http://www.securityfocus.com/bid/98313 https://ghostbin.com/paste/q2vq2 https://ics-cert.us-cert.gov/advisories/ICSA-17-124-01

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

CHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

10.0