CVE-2017-7921, CVE-2021-22681: CISA KEV: Hikvision Cameras + Rockwell Logix OT/IC

Type	Value	Context	Confidence
FILE_PATH	/etc/passwd	Unauthorized access to /etc/passwd via unauthenticated HTTP requests to Hikvision camera ISAPI endpoint; unexpected when accessed by non-root external processes	high
FILE_PATH	/etc/shadow	Suspicious when unauthenticated or non-privileged processes access /etc/shadow on Hikvision cameras exploiting CVE-2017-7921, as legitimate access occurs exclusively through authenticated root operations during password management, whereas this exploit bypasses authentication to exfiltrate credential hashes for lateral movement and credential stuffing - detect in logs via unauthorized file read attempts from web service processes (e.g., lighttpd, nginx), absence of corresponding sudo/su audit entries, and credential hash exfiltration over network channels outside normal administrative channels.	high
FILE_PATH	/proc/net/tcp	Attackers exploiting Hikvision cameras may read network connection state from proc filesystem after gaining unauthorized access	medium
FILE_PATH	/mnt/flash/	Hikvision camera firmware and configuration files stored in flash mount may be accessed via CVE-2017-7921 exploitation	medium
FILE_PATH	/tmp/malware	Use of /tmp/malware directory on Hikvision camera devices is suspicious when staging files prior to execution or persistence mechanisms, as legitimate camera firmware and services do not write to arbitrarily named malware directories; detection should focus on file creation events in /tmp/malware followed by chmod/chown operations or process execution from this path, which differs from normal camera operations that use manufacturer-defined temporary directories like /tmp or /var/tmp for legitimate logging and cache purposes.	medium
FILE_PATH	/var/run/	Runtime files on Hikvision cameras may be modified by attackers exploiting authentication bypass to persist access	low
FILE_PATH	/home/httpd/	Hikvision web server root directory targeted during CVE-2017-7921 ISAPI exploitation attempts	high
FILE_PATH	/Rockwell/RSLogix/	Rockwell Automation Studio 5000 Logix Designer project files targeted via CVE-2021-22681 CIP cryptographic vulnerability	high
FILE_PATH	/Program Files (x86)/Rockwell Software/Studio 5000/	Rockwell Studio 5000 installation directory targeted by CVE-2021-22681 allowing forged CIP connections to Logix controllers	high
FILE_PATH	/Program Files/Rockwell Software/RSLinx/	RSLinx Classic installation path relevant to Rockwell Logix CVE-2021-22681 exploitation chain targeting OT communication layer	medium
FILE_PATH	/var/log/auth.log	Authentication log file on Hikvision Linux-based cameras that is suspicious when showing repeated failed login attempts followed by successful authentication without corresponding credential entries, or when access patterns indicate CVE-2017-7921 exploitation attempts; legitimate use involves standard SSH/login authentication logging whereas exploitation attempts typically show privilege escalation or unauthenticated access grants coinciding with HTTP request logs showing camera interface manipulation.	medium
FILE_PATH	/tmp/	Suspicious when Hikvision camera processes write executable files, scripts, or binaries to /tmp/ outside of documented firmware update procedures, as legitimate device operations use manufacturer-controlled staging paths; detect via EDR monitoring for unsigned binary writes, script execution from /tmp/, or persistence mechanisms following network connections from external sources, privilege escalation attempts, or unexpected process spawning (e.g., shell interpreters, curl/wget downloads), and differentiate from legitimate firmware staging by confirming writes occur during scheduled updates via authenticated channels rather than spontaneous external connections or unusual parent processes.	medium