# CVE-2021-36260

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.

- Page: https://www.vulneraibility.com/cve/CVE-2021-36260
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2022-01-10; CISA due date 2022-01-24
- EPSS: 99.87% (percentile 100.0)
- Public exploit code: 1 on Exploit-DB · 1 Metasploit module · 14 GitHub proofs of concept · 1 Nuclei template (first 2021-10-18)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2025-02-06)
- Weakness: CWE-78
- Published: 2021-09-22

## Affected

- hikvision:ds-2cd2026g2-iu\/sl_firmware
- hikvision:ds-2cd2046g2-iu\/sl_firmware
- hikvision:ds-2cd2066g2-i\(u\)_firmware
- hikvision:ds-2cd2066g2-iu\/sl_firmware
- hikvision:ds-2cd2086g2-i\(u\)_firmware
- hikvision:ds-2cd2086g2-iu\/sl_firmware
- hikvision:ds-2cd2166g2-i\(su\)_firmware
- hikvision:ds-2cd2186g2-i\(su\)_firmware
- hikvision:ds-2cd2186g2-isu_firmware
- hikvision:ds-2cd2326g2-isu\/sl_firmware
- hikvision:ds-2cd2346g2-isu\/sl_firmware
- hikvision:ds-2cd2366g2-i\(u\)_firmware
- hikvision:ds-2cd2366g2-isu\/sl_firmware
- hikvision:ds-2cd2386g2-i\(u\)_firmware
- hikvision:ds-2cd2386g2-isu\/sl_firmware
- hikvision:ds-2cd2426g2-i_firmware
- hikvision:ds-2cd2446g2-i_firmware
- hikvision:ds-2cd2526g2-i\(s\)_firmware
- hikvision:ds-2cd2526g2-is_firmware
- hikvision:ds-2cd2546g2-i\(s\)_firmware
- hikvision:ds-2cd2566g2-i\(s\)_firmware
- hikvision:ds-2cd2586g2-i\(s\)_firmware
- hikvision:ds-2cd2626g2-izsu\/sl_firmware
- hikvision:ds-2cd2646g2-izsu\/sl_firmware
- hikvision:ds-2cd2666g2-izs_firmware
- hikvision:ds-2cd2666g2-izsu\/sl_firmware
- hikvision:ds-2cd2686g2-izs_firmware
- hikvision:ds-2cd2686g2-izsu\/sl_firmware
- hikvision:ds-2cd2766g2-izs_firmware
- hikvision:ds-2cd2786g2-izs_firmware

## References

- [other] https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification-command-injection-vulnerability-in-some-hikvision-products/
- [other] http://packetstormsecurity.com/files/164603/Hikvision-Web-Server-Build-210702-Command-Injection.html
- [other] http://packetstormsecurity.com/files/166167/Hikvision-IP-Camera-Unauthenticated-Command-Injection.html
- [other] https://www.cyfirma.com/wp-content/uploads/2022/08/HikvisionSurveillanceCamerasVulnerabilities.pdf
- [other] https://therecord.media/experts-warn-of-widespread-exploitation-involving-hikvision-cameras/
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-36260

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.