CVE-2021-36260

Q: What is the severity of CVE-2021-36260?

CVE-2021-36260 has a CVSS score of 9.8 (CRITICAL). CVE-2021-36260 is a critical command injection vulnerability in Hikvision web servers that allows unauthenticated attackers to execute arbitrary commands on affected devices. This affects various Hikvision surveillance products including IP cameras, NVRs, and access control systems. Organizations using vulnerable Hikvision devices are at risk of complete system compromise.

9.8 CRITICAL

Remote Code Execution

📋 TL;DR

CVE-2021-36260 is a critical command injection vulnerability in Hikvision web servers that allows unauthenticated attackers to execute arbitrary commands on affected devices. This affects various Hikvision surveillance products including IP cameras, NVRs, and access control systems. Organizations using vulnerable Hikvision devices are at risk of complete system compromise.

💻 Affected Systems

Products:

Hikvision IP cameras
Hikvision NVRs
Hikvision access control systems
Various Hikvision surveillance products

Versions: Multiple firmware versions prior to September 2021 patches

Operating Systems: Embedded Linux systems in Hikvision devices

Default Config Vulnerable: ⚠️ Yes

Notes: Affects devices with web interface enabled. Exact product list varies; check Hikvision advisory for specific models.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system takeover, installation of persistent backdoors, lateral movement to internal networks, data exfiltration, and device bricking.

🟠

Likely Case

Unauthenticated remote code execution leading to camera manipulation, surveillance footage theft, credential harvesting, and botnet recruitment.

🟢

If Mitigated

Limited impact if devices are isolated in separate VLANs with strict network segmentation and egress filtering.

🌐 Internet-Facing: HIGH - Directly exploitable from the internet without authentication, making exposed devices immediate targets.

🏢 Internal Only: HIGH - Even internally, the vulnerability requires no authentication and can be exploited by any network-accessible attacker.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: CONFIRMED

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Multiple public exploit scripts available. Actively exploited in the wild since 2021. Exploitation requires sending specially crafted HTTP requests to vulnerable endpoints.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Firmware updates released September 2021 and later

Vendor Advisory: https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification-command-injection-vulnerability-in-some-hikvision-products/

Restart Required: Yes

Instructions:

1. Identify affected Hikvision devices. 2. Download latest firmware from Hikvision portal. 3. Backup configuration. 4. Apply firmware update via web interface. 5. Reboot device. 6. Verify update successful.

🔧 Temporary Workarounds

Network Segmentation

all

Isolate Hikvision devices in separate VLAN with strict firewall rules

Web Interface Restriction

linux

Block external access to web interface via firewall rules

iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP

🧯 If You Can't Patch

Immediately isolate affected devices from internet and critical internal networks
Implement strict network access controls allowing only necessary traffic to/from devices

🔍 How to Verify

Check if Vulnerable:

Check device firmware version against Hikvision advisory. Test with nmap scripts or Metasploit module.

Check Version:

Check web interface System Information page or use SNMP queries if enabled

Verify Fix Applied:

Verify firmware version is patched (post-September 2021). Test with known exploit scripts to confirm failure.

📡 Detection & Monitoring

Log Indicators:

Unusual HTTP POST requests to device management endpoints
Command execution patterns in system logs
Failed authentication attempts followed by successful command execution

Network Indicators:

HTTP requests containing command injection payloads to /SDK/webLanguage
Unusual outbound connections from surveillance devices
Traffic to known C2 servers from IoT devices

SIEM Query:

source="hikvision*" AND (url="*/SDK/webLanguage*" OR http_method="POST" AND uri_contains("$" OR "|" OR ";"))

📊 Metadata

CVE ID: CVE-2021-36260

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-78

Published: September 22, 2021

Last Updated: November 10, 2025

🔗 References

http://packetstormsecurity.com/files/164603/Hikvision-Web-Server-Build-210702-Command-Injection.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/166167/Hikvision-IP-Camera-Unauthenticated-Command-Injection.html Exploit,Third Party Advisory,VDB Entry
https://therecord.media/experts-warn-of-widespread-exploitation-involving-hikvision-cameras/ Third Party Advisory
https://www.cyfirma.com/wp-content/uploads/2022/08/HikvisionSurveillanceCamerasVulnerabilities.pdf Broken Link,Exploit,Third Party Advisory
https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification-command-injection-vulnerability-in-some-hikvision-products/ Vendor Advisory
http://packetstormsecurity.com/files/164603/Hikvision-Web-Server-Build-210702-Command-Injection.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/166167/Hikvision-IP-Camera-Unauthenticated-Command-Injection.html Exploit,Third Party Advisory,VDB Entry
https://therecord.media/experts-warn-of-widespread-exploitation-involving-hikvision-cameras/ Third Party Advisory
https://www.cyfirma.com/wp-content/uploads/2022/08/HikvisionSurveillanceCamerasVulnerabilities.pdf Broken Link,Exploit,Third Party Advisory
https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification-command-injection-vulnerability-in-some-hikvision-products/ Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-36260 US Government Resource

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Ds 2cd2021g1 I\(w\) Firmware by Hikvision

Ds 2cd2021g1 I\(w\) Firmware by Hikvision

Ds 2cd2023g2 I\(u\) Firmware by Hikvision

Ds 2cd2023g2 I\(u\) Firmware by Hikvision

Ds 2cd2026g2 Iu\/sl Firmware by Hikvision

Ds 2cd2027g2 L\(u\) Firmware by Hikvision

Ds 2cd2027g2 Lu\/sl Firmware by Hikvision

Ds 2cd2043g2 I\(u\) Firmware by Hikvision

Ds 2cd2043g2 I\(u\) Firmware by Hikvision

Ds 2cd2046g2 Iu\/sl Firmware by Hikvision

Ds 2cd2047g2 L\(u\) Firmware by Hikvision

Ds 2cd2063g2 I\(u\) Firmware by Hikvision

Ds 2cd2063g2 I\(u\) Firmware by Hikvision

Ds 2cd2066g2 I\(u\) Firmware by Hikvision

Ds 2cd2066g2 Iu\/sl Firmware by Hikvision

Ds 2cd2083g2 I\(u\) Firmware by Hikvision

Ds 2cd2083g2 I\(u\) Firmware by Hikvision

Ds 2cd2086g2 I\(u\) Firmware by Hikvision

Ds 2cd2086g2 Iu\/sl Firmware by Hikvision

Ds 2cd2087g2 L\(u\) Firmware by Hikvision

Ds 2cd2121g0 I\(w\)\(s\) Firmware by Hikvision

Ds 2cd2121g1 Firmware by Hikvision

Ds 2cd2121g1 I\(w\) Firmware by Hikvision

Ds 2cd2121g1 Idw Firmware by Hikvision

Ds 2cd2121g1 Idw Firmware by Hikvision

Ds 2cd2121g1 Idw Firmware by Hikvision

Ds 2cd2123g2 I\(s\) Firmware by Hikvision

Ds 2cd2123g2 I\(s\) Firmware by Hikvision

Ds 2cd2123g2 Iu Firmware by Hikvision

Ds 2cd2123g2 Iu Firmware by Hikvision

Ds 2cd2127g2 \( Su\) Firmware by Hikvision

Ds 2cd2143g2 I\(s\) Firmware by Hikvision

Ds 2cd2143g2 I\(s\) Firmware by Hikvision

Ds 2cd2143g2 Iu Firmware by Hikvision

Ds 2cd2143g2 Iu Firmware by Hikvision

Ds 2cd2147g2 L\(su\) Firmware by Hikvision

Ds 2cd2163g2 I\(s\) Firmware by Hikvision

Ds 2cd2163g2 I\(s\) Firmware by Hikvision

Ds 2cd2163g2 Iu Firmware by Hikvision

Ds 2cd2166g2 I\(su\) Firmware by Hikvision

Ds 2cd2183g2 I\(s\) Firmware by Hikvision

Ds 2cd2183g2 I\(s\) Firmware by Hikvision

Ds 2cd2183g2 I\(u\) Firmware by Hikvision

Ds 2cd2183g2 Iu Firmware by Hikvision

Ds 2cd2183g2 Iu Firmware by Hikvision

Ds 2cd2186g2 I\(su\) Firmware by Hikvision

Ds 2cd2186g2 Isu Firmware by Hikvision

Ds 2cd2321g0 I\/nf Firmware by Hikvision

Ds 2cd2323g2 I\(u\) Firmware by Hikvision

Ds 2cd2323g2 I\(u\) Firmware by Hikvision

Ds 2cd2326g2 Isu\/sl Firmware by Hikvision

Ds 2cd2327g2 L\(u\) Firmware by Hikvision

Ds 2cd2343g2 I\(u\) Firmware by Hikvision

Ds 2cd2343g2 I\(u\) Firmware by Hikvision

Ds 2cd2346g2 Isu\/sl Firmware by Hikvision

Ds 2cd2347g2 L\(u\) Firmware by Hikvision

Ds 2cd2347g2 Lsu\/sl Firmware by Hikvision

Ds 2cd2363g2 I\(u\) Firmware by Hikvision

Ds 2cd2363g2 I\(u\) Firmware by Hikvision

Ds 2cd2366g2 I\(u\) Firmware by Hikvision

Ds 2cd2366g2 Isu\/sl Firmware by Hikvision

Ds 2cd2383g2 I\(u\) Firmware by Hikvision

Ds 2cd2386g2 I\(u\) Firmware by Hikvision

Ds 2cd2386g2 Isu\/sl Firmware by Hikvision

Ds 2cd2387g2 L\(u\) Firmware by Hikvision

Ds 2cd2421g0 I\(d\)\(w\) Firmware by Hikvision

Ds 2cd2421g0 I\(d\)\(w\) Firmware by Hikvision

Ds 2cd2426g2 I Firmware by Hikvision

Ds 2cd2446g2 I Firmware by Hikvision

Ds 2cd2523g2 I\(s\) Firmware by Hikvision

Ds 2cd2523g2 I\(s\) Firmware by Hikvision

Ds 2cd2523g2 I\(u\) Firmware by Hikvision

Ds 2cd2526g2 I\(s\) Firmware by Hikvision

Ds 2cd2526g2 Is Firmware by Hikvision

Ds 2cd2527g2 Ls Firmware by Hikvision

Ds 2cd2543g2 I\(ws\) Firmware by Hikvision

Ds 2cd2543g2 I\(ws\) Firmware by Hikvision