Hikvision · Security cameras web server
CVE-2021-36260
Hikvision Improper Input Validation
Exploited in attacks
Critical 9.8 Attack chance: 99.9%
What it is
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.
CISA: A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: January 24, 2022
- Added to the CISA list
- January 10, 2022
- Published
- September 22, 2021
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 99.9% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-78
- More details
- NVD · CVE.org · CISA
All references (5)
- https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification-command-injection-…
- http://packetstormsecurity.com/files/164603/Hikvision-Web-Server-Build-210702-Command-Injection.html
- http://packetstormsecurity.com/files/166167/Hikvision-IP-Camera-Unauthenticated-Command-Injection.html
- https://www.cyfirma.com/wp-content/uploads/2022/08/HikvisionSurveillanceCamerasVulnerabilities.pdf
- https://therecord.media/experts-warn-of-widespread-exploitation-involving-hikvision-cameras/
More exploited flaws from Hikvision
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Mar 5, 2026 | Improper Authentication | Multiple Products | Critical 9.8 | >99.9% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.