Actively exploited · Published Sep 22, 2021 · Assigned by hikvision
CVE-2021-36260
Critical 9.8 Exploited
In plain English
A critical-severity OS command injection in Security cameras web server from Hikvision. Attackers are actively exploiting it in the wild (listed by CISA on January 10, 2022). The chance it is exploited in the next 30 days is estimated at 99.9% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jan 24, 2022.
Official description
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.
Affected products (as reported)
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification-command-injection-vulnerability-in-some-hikvision-products/ x_refsource_MISC
- http://packetstormsecurity.com/files/164603/Hikvision-Web-Server-Build-210702-Command-Injection.html x_refsource_MISC
- http://packetstormsecurity.com/files/166167/Hikvision-IP-Camera-Unauthenticated-Command-Injection.html x_refsource_MISC
- https://www.cyfirma.com/wp-content/uploads/2022/08/HikvisionSurveillanceCamerasVulnerabilities.pdf x_refsource_MISC
- https://therecord.media/experts-warn-of-widespread-exploitation-involving-hikvision-cameras/ x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-36260 government-resource