CVE-2021-36260
Hikvision Improper Input Validation
Description
CVE-2021-36260 is a critical-severity command injection vulnerability in the web server of Hikvision security cameras and other Hikvision products. Due to insufficient input validation, an unauthenticated attacker can exploit this vulnerability by sending specially crafted messages with malicious commands to the web server, achieving arbitrary command execution on the device. This command injection vulnerability in Hikvision cameras affects a wide range of product models and carries a CVSS score of 9.8. CISA has added CVE-2021-36260 to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 94.44% (99.99th percentile), exploitation is near-certain and widespread.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| hikvision | ds-2cd2026g2-iu\/sl firmware | - |
| hikvision | ds-2cd2046g2-iu\/sl firmware | - |
| hikvision | ds-2cd2066g2-i\(u\) firmware | - |
| hikvision | ds-2cd2066g2-iu\/sl firmware | - |
| hikvision | ds-2cd2086g2-i\(u\) firmware | - |
| hikvision | ds-2cd2086g2-iu\/sl firmware | - |
| hikvision | ds-2cd2166g2-i\(su\) firmware | - |
| hikvision | ds-2cd2186g2-i\(su\) firmware | - |
| hikvision | ds-2cd2186g2-isu firmware | - |
| hikvision | ds-2cd2326g2-isu\/sl firmware | - |
| hikvision | ds-2cd2346g2-isu\/sl firmware | - |
| hikvision | ds-2cd2366g2-i\(u\) firmware | - |
| hikvision | ds-2cd2366g2-isu\/sl firmware | - |
| hikvision | ds-2cd2386g2-i\(u\) firmware | - |
| hikvision | ds-2cd2386g2-isu\/sl firmware | - |
| hikvision | ds-2cd2426g2-i firmware | - |
| hikvision | ds-2cd2446g2-i firmware | - |
| hikvision | ds-2cd2526g2-i\(s\) firmware | - |
| hikvision | ds-2cd2526g2-is firmware | - |
| hikvision | ds-2cd2546g2-i\(s\) firmware | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/164603/Hikvision-Web-Server-Build-210702-Command-Injection.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/166167/Hikvision-IP-Camera-Unauthenticated-Command-Injection.html(Exploit, Third Party Advisory, VDB Entry)
- https://therecord.media/experts-warn-of-widespread-exploitation-involving-hikvision-cameras/(Third Party Advisory)
- https://www.cyfirma.com/wp-content/uploads/2022/08/HikvisionSurveillanceCamerasVulnerabilities.pdf(Broken Link, Exploit, Third Party Advisory)
- https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification-command-injection-vulnerability-in-some-hikvision-products/(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-36260(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
In the context of CVE-2021-36260, the web server component of Hikvision security cameras fails to properly validate and neutralize user-supplied input before incorporating it into operating system commands. This OS command injection weakness allows unauthenticated remote attackers to inject arbitrary commands through specially crafted HTTP messages, which are then executed by the camera’s underlying operating system.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Impact Analysis
CVE-2021-36260 carries a CVSS 3.1 score of 9.8 (CRITICAL), representing the highest tier of vulnerability severity. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication whatsoever, and needs no user interaction. Confidentiality (High): attackers gain full access to the camera’s stored video footage, configuration data, and network credentials. Integrity (High): attackers can modify camera configurations, disable recording, implant backdoors, or use the compromised device as a pivot point into the internal network. Availability (High): attackers can disable cameras, disrupt surveillance operations, or enlist the devices into botnets for DDoS attacks. The EPSS score of 94.44% places this vulnerability in the 99.99th percentile, indicating near-certain and widespread exploitation. Given that Hikvision cameras are among the most widely deployed surveillance devices globally, the potential impact spans critical infrastructure, enterprise, and residential environments.
Exploit Maturity
CVE-2021-36260 has one of the most mature exploit landscapes among IoT vulnerabilities. Public exploit code is available via Packet Storm Security and a second exploit for unauthenticated command injection, both confirmed as working exploits. CISA has confirmed active exploitation in the wild through its KEV catalog listing, with a remediation deadline of 2022-01-24. The EPSS score of 94.44% (99.99th percentile) indicates near-certain exploitation, making this one of the most actively exploited IoT vulnerabilities. Security researchers have documented widespread exploitation campaigns targeting internet-facing Hikvision cameras, with compromised devices being used for botnet recruitment and as network entry points.
Remediation
- Apply Hikvision firmware updates immediately as required by CISA KEV: follow the vendor instructions in the Hikvision security notification to update all affected camera models to patched firmware versions.
- Isolate Hikvision cameras on a dedicated network segment (VLAN) separated from critical business networks, with strict firewall rules preventing direct internet access and limiting communication to only the video management system.
- Disable direct internet exposure of Hikvision camera web interfaces. If remote access is required, use a VPN or zero-trust network access solution rather than exposing camera management ports directly to the internet.
- Change default credentials on all Hikvision devices and implement strong, unique passwords for each camera. Enable HTTPS for management access and disable unnecessary network services on the devices.
- Monitor network traffic from camera segments for indicators of compromise, including unexpected outbound connections, unusual DNS queries, command-and-control communication patterns, and abnormal bandwidth usage that may indicate botnet participation.
Technical Details
CVE-2021-36260 is a critical OS command injection vulnerability (CWE-78) in the web server component of Hikvision security cameras. The web server fails to perform sufficient input validation on incoming HTTP messages, allowing unauthenticated attackers to inject operating system commands through specially crafted requests. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects the worst-case exploitability: the attack is network-based, requires no authentication or user interaction, and has low complexity. The injected commands execute with the privileges of the web server process on the camera’s embedded Linux operating system, typically root-level access. The vulnerability affects a vast number of Hikvision camera models across multiple product families, as they share the same vulnerable web server codebase. The straightforward exploitation path—requiring only a crafted HTTP request to an exposed camera—combined with the large number of internet-facing Hikvision devices makes this vulnerability particularly dangerous.
Frequently Asked Questions
Is CVE-2021-36260 being actively exploited?
Yes. CVE-2021-36260 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 94.44% (99.99th percentile) indicates near-certain exploitation. Multiple public exploits are available, and security researchers have documented widespread exploitation campaigns targeting internet-facing Hikvision cameras.
What products are affected by CVE-2021-36260?
CVE-2021-36260 affects a wide range of Hikvision security camera models and IP camera product families. The vulnerability is in the shared web server component used across numerous Hikvision DS-series camera models. Hikvision’s security advisory lists the complete set of affected products and firmware versions.
How do I fix CVE-2021-36260?
Apply the firmware updates provided by Hikvision through their security advisory. Immediately isolate affected cameras on a dedicated network segment and remove any direct internet exposure. Use a VPN for remote access instead of exposing camera web interfaces directly, and change all default credentials.
How severe is CVE-2021-36260?
CVE-2021-36260 has a CVSS 3.1 score of 9.8 (CRITICAL) and an EPSS score in the 99.99th percentile, making it one of the most severe and actively exploited IoT vulnerabilities. It allows unauthenticated remote command execution on affected Hikvision cameras, potentially leading to complete device takeover, surveillance disruption, and network compromise.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.