Medium Severity
CVE-2017-7921
Published: Nov 5, 2026
This project is a single-target proof of concept (PoC) for assessing exposure to CVE-2017-7921, an authentication-bypass vulnerability affecting certain Hikvision IP camera and NVR firmware. The script attempts to retrieve a device configuration file and, when the returned data matches the format implemented in this PoC, decrypts and parses it to
<div align="center">
<img src="https://www.python.org/static/community_logos/python-logo.png" alt="Python" height="72">
# Hikvision CCTV — CVE-2017-7921 Proof of Concept
**Authorized security assessment tool for Hikvision camera and NVR devices**
<img src="https://img.shields.io/badge/DEVICE-CCTV%20%2F%20NVR-263238?style=for-the-badge&logo=securityscorecard&logoColor=white" alt="CCTV / NVR">
<img src="https://img.shields.io/badge/LANGUAGE-Python%203-3776AB?style=for-the-badge&logo=python&logoColor=white" alt="Python 3">
<img src="https://img.shields.io/badge/CVE-2017--7921-B22222?style=for-the-badge" alt="CVE-2017-7921">
</div>
---
## Overview
This project is a single-target proof of concept (PoC) for assessing exposure to **CVE-2017-7921**, an authentication-bypass vulnerability affecting certain Hikvision IP camera and NVR firmware.
The script attempts to retrieve a device configuration file and, when the returned data matches the format implemented in this PoC, decrypts and parses it to identify administrator records. It can also attempt to retrieve a JPEG snapshot through the device's snapshot endpoint.
This tool is intended strictly for **authorized security testing**, such as assessing devices you own or systems for which you have explicit written permission.
> **Important:** A successful HTTP response does not, by itself, prove that a device is vulnerable. Firmware behavior, endpoint availability, configuration format, and device model can affect the result.
## Features
- Tests a single camera or NVR host.
- Checks a small set of authentication tokens used by this PoC.
- Requests the device configuration endpoint.
- Attempts to decrypt configuration data using the AES-128-ECB and per-file XOR steps implemented in the script.
- Searches the decoded configuration for administrator records.
- Masks discovered password values by default.
- Offers an explicit option to display full password values.
- Optionally saves the decoded configuration.
- Can a