CVE-2021-36260 KEV EXPLOIT
9.8
CRITICAL · CVSS 3.1 · EPSS 99.9% (pctl 100)
Patch first
On CISA KEV — known exploited in the wild, due 2022-01-24.
Description
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 99.87% — more likely to be exploited than 100% of all CVEs |
| Weakness | CWE-78 |
| On CISA KEV | yes — remediate by 2022-01-24 |
| Public exploit | yes |
| Published | 2021-09-22 |
| Last modified | 2026-06-17 |
CISA KEV
| Name | Hikvision Improper Input Validation |
|---|---|
| Added | 2022-01-10 |
| Due | 2022-01-24 |
| Vendor / product | Hikvision / Security cameras web server |
| Ransomware use | none reported |
Affected (40)
| Vendor | Product |
|---|---|
| hikvision | ds-2cd2026g2-iu\/sl |
| hikvision | ds-2cd2026g2-iu\/sl firmware |
| hikvision | ds-2cd2046g2-iu\/sl |
| hikvision | ds-2cd2046g2-iu\/sl firmware |
| hikvision | ds-2cd2066g2-i\(u\) |
| hikvision | ds-2cd2066g2-i\(u\) firmware |
| hikvision | ds-2cd2066g2-iu\/sl |
| hikvision | ds-2cd2066g2-iu\/sl firmware |
| hikvision | ds-2cd2086g2-i\(u\) |
| hikvision | ds-2cd2086g2-i\(u\) firmware |
| hikvision | ds-2cd2086g2-iu\/sl |
| hikvision | ds-2cd2086g2-iu\/sl firmware |
| hikvision | ds-2cd2166g2-i\(su\) |
| hikvision | ds-2cd2166g2-i\(su\) firmware |
| hikvision | ds-2cd2186g2-i\(su\) |
| hikvision | ds-2cd2186g2-i\(su\) firmware |
| hikvision | ds-2cd2186g2-isu |
| hikvision | ds-2cd2186g2-isu firmware |
| hikvision | ds-2cd2326g2-isu\/sl |
| hikvision | ds-2cd2326g2-isu\/sl firmware |
| hikvision | ds-2cd2346g2-isu\/sl |
| hikvision | ds-2cd2346g2-isu\/sl firmware |
| hikvision | ds-2cd2366g2-i\(u\) |
| hikvision | ds-2cd2366g2-i\(u\) firmware |
| hikvision | ds-2cd2366g2-isu\/sl |
| hikvision | ds-2cd2366g2-isu\/sl firmware |
| hikvision | ds-2cd2386g2-i\(u\) |
| hikvision | ds-2cd2386g2-i\(u\) firmware |
| hikvision | ds-2cd2386g2-isu\/sl |
| hikvision | ds-2cd2386g2-isu\/sl firmware |
| hikvision | ds-2cd2426g2-i |
| hikvision | ds-2cd2426g2-i firmware |
| hikvision | ds-2cd2446g2-i |
| hikvision | ds-2cd2446g2-i firmware |
| hikvision | ds-2cd2526g2-i\(s\) |
| hikvision | ds-2cd2526g2-i\(s\) firmware |
| hikvision | ds-2cd2526g2-is |
| hikvision | ds-2cd2526g2-is firmware |
| hikvision | ds-2cd2546g2-i\(s\) |
| hikvision | ds-2cd2546g2-i\(s\) firmware |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Hikvision Web Server Build 210702 - Command Injection | 2021-10-25 |
References
- http://packetstormsecurity.com/files/164603/Hikvision-Web-Server-Build-210702-Command-Injection.html
- http://packetstormsecurity.com/files/166167/Hikvision-IP-Camera-Unauthenticated-Command-Injection.html
- https://therecord.media/experts-warn-of-widespread-exploitation-involving-hikvision-cameras/
- https://www.cyfirma.com/wp-content/uploads/2022/08/HikvisionSurveillanceCamerasVulnerabilities.pdf
- https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification-command-injection-vulnerability-in-some-hikvision-products/
- http://packetstormsecurity.com/files/164603/Hikvision-Web-Server-Build-210702-Command-Injection.html
- http://packetstormsecurity.com/files/166167/Hikvision-IP-Camera-Unauthenticated-Command-Injection.html
- https://therecord.media/experts-warn-of-widespread-exploitation-involving-hikvision-cameras/
- https://www.cyfirma.com/wp-content/uploads/2022/08/HikvisionSurveillanceCamerasVulnerabilities.pdf
- https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification-command-injection-vulnerability-in-some-hikvision-products/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-36260
→ the Explorer · watch your stack · NVD