Command Injection Flaw in Hikvision Web Server
CVE-2021-36260

9.8CRITICAL

Key Information:

Vendor: Hikvision
Status: Ds-2cd2026g2-iu\/sl Firmware
Vendor: CVE Published:; 22 September 2021

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 94%🦅 CISA Reported

What is CVE-2021-36260?

A command injection vulnerability exists in the web server of certain Hikvision products. This vulnerability arises from inadequate validation of user inputs, allowing attackers to execute arbitrary commands. By sending specially crafted messages that include malicious commands, an attacker can exploit this weakness, potentially leading to unauthorized access or control over affected devices. Organizations using these Hikvision products should be vigilant and apply updates to mitigate the risks associated with this vulnerability.

CISA has reported CVE-2021-36260

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2021-36260 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply updates per vendor instructions.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2021-36260 - Proof of Concept

CVE-2021-36260
Created by Aiminsun

CVE-2021-36260
Created by Cuerz