CISA Flags Hikvision and Rockwell Automation CVSS 9.8 Flaws as Actively Exploited — Patch by March 26

Two separate vulnerabilities are involved here. CVE-2017-7921 is an improper authentication flaw in Hikvision cameras and DVRs. Improper authentication means an attacker can bypass the login process entirely — accessing camera feeds, configuration settings, stored credentials, and in some cases escalating to full device control without knowing any password. This vulnerability has had a public Metasploit exploit module available for years, meaning automated tools can find and attack vulnerable cameras with minimal effort. CVE-2021-22681 affects Rockwell Automation's Logix ecosystem — industrial engineering software and programmable logic controllers used in manufacturing plants, utilities, and critical infrastructure. The flaw involves insufficiently protected credentials that allow an attacker to impersonate a trusted engineering workstation, potentially enabling unauthorized access to modify controller logic and configuration — exactly the kind of access that could cause physical damage in industrial environments.

CISA's decision to add vulnerabilities to the KEV catalog is significant — it means they have evidence of active exploitation happening right now, not theoretical risk. For the Hikvision flaw specifically, government reporting has linked HiatusRAT — a sophisticated threat actor — to active scanning campaigns targeting CVE-2017-7921 on internet-exposed cameras and DVRs. The geopolitical timing is also notable: with ongoing tensions in multiple regions, surveillance infrastructure like cameras is a known target for nation-state actors looking for persistent access or intelligence gathering. For the Rockwell flaw, exploitation in industrial environments carries severe consequences beyond data theft — attackers with access to programmable logic controllers can potentially disrupt physical operations, shut down production lines, or cause equipment damage.