CVE-2021-36260

CVE-2021-36260 is a critical-severity (CVSS 9.8) vulnerability in Hikvision Security cameras web server. CISA added it to the Known Exploited Vulnerabilities catalog on January 10, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by January 24, 2022. CISA does not currently list it as used in ransomware campaigns. Hikvision has 2 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• http://packetstormsecurity.com/files/164603/Hikvision-Web-Server-Build-210702-Command-Injection.html
• http://packetstormsecurity.com/files/166167/Hikvision-IP-Camera-Unauthenticated-Command-Injection.html
• https://therecord.media/experts-warn-of-widespread-exploitation-involving-hikvision-cameras/
• https://www.cyfirma.com/wp-content/uploads/2022/08/HikvisionSurveillanceCamerasVulnerabilities.pdf
• https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification-command-injection-vulnerability-in-some-hikvision-products/
• http://packetstormsecurity.com/files/164603/Hikvision-Web-Server-Build-210702-Command-Injection.html
• http://packetstormsecurity.com/files/166167/Hikvision-IP-Camera-Unauthenticated-Command-Injection.html
• https://therecord.media/experts-warn-of-widespread-exploitation-involving-hikvision-cameras/