9.8Critical
KEV
CVE-2021-36260Hikvision Improper Input Validation
Known exploited — Hikvision Improper Input Validation
CISA confirmed this vulnerability is used in real attacks on 10.01.2022. Remediation deadline for US federal agencies: 24.01.2022.
Required action: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2021-36260
Description
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.
Weakness (CWE):
CWE-78
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
References and patches
- https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification-command-injection-… Vendor Advisory
- http://packetstormsecurity.com/files/164603/Hikvision-Web-Server-Build-210702-Command-Injection.html ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/166167/Hikvision-IP-Camera-Unauthenticated-Command-Injection.html ExploitThird Party AdvisoryVDB Entry
- https://www.cyfirma.com/wp-content/uploads/2022/08/HikvisionSurveillanceCamerasVulnerabilities.pdf Broken LinkExploitThird Party Advisory
- https://therecord.media/experts-warn-of-widespread-exploitation-involving-hikvision-cameras/ Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-36260 US Government Resource
CPE matches (NVD) (60)
cpe:2.3:o:hikvision:ds-2cd2026g2-iu\/sl_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2046g2-iu\/sl_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2066g2-i\(u\)_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2066g2-iu\/sl_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2086g2-i\(u\)_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2086g2-iu\/sl_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2166g2-i\(su\)_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2186g2-i\(su\)_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2186g2-isu_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2326g2-isu\/sl_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2346g2-isu\/sl_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2366g2-i\(u\)_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2366g2-isu\/sl_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2386g2-i\(u\)_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2386g2-isu\/sl_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2426g2-i_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2446g2-i_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2526g2-i\(s\)_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2526g2-is_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2546g2-i\(s\)_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2566g2-i\(s\)_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2586g2-i\(s\)_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2626g2-izsu\/sl_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2646g2-izsu\/sl_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2666g2-izs_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2666g2-izsu\/sl_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2686g2-izs_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2686g2-izsu\/sl_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2766g2-izs_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2786g2-izs_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2027g2-l\(u\)_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2047g2-l\(u\)_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2027g2-lu\/sl_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2087g2-l\(u\)_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2127g2-\(-su\)_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2147g2-l\(su\)_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2327g2-l\(u\)_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2347g2-l\(u\)_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2347g2-lsu\/sl_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2387g2-l\(u\)_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2527g2-ls_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2547g2-ls_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2547g2-lzs_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2121g0-i\(w\)\(s\)_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2321g0-i\/nf_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2421g0-i\(d\)\(w\)_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2421g0-i\(d\)w_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2621g0-i\(z\)\(s\)_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2721g0-i\(z\)\(s\)_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2121g1-i\(w\)_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2121g1_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2121g1-idw_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2023g2-i\(u\)_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2043g2-i\(u\)_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2063g2-i\(u\)_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2083g2-i\(u\)_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2123g2-i\(s\)_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2123g2-iu_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2143g2-i\(s\)_firmware:-:*:*:*:*:*:*:*cpe:2.3:o:hikvision:ds-2cd2143g2-iu_firmware:-:*:*:*:*:*:*:*