CVEvulnerability

CVE-2021-36260

9.8 CRITICAL Known exploited Published 2021-09-22 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Hikvision Improper Input Validation — Hikvision Security cameras web server

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation.

Added to KEV
2022-01-10
Remediation due
2022-01-24
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2021-36260
Status
Analyzed
Published
2021-09-22
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
CWE-78

Description

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.

Affected configurations

• hikvision ds-2cd2026g2-iu\/sl firmware • hikvision ds-2cd2046g2-iu\/sl firmware • hikvision ds-2cd2066g2-i\(u\) firmware • hikvision ds-2cd2066g2-iu\/sl firmware • hikvision ds-2cd2086g2-i\(u\) firmware • hikvision ds-2cd2086g2-iu\/sl firmware • hikvision ds-2cd2166g2-i\(su\) firmware • hikvision ds-2cd2186g2-i\(su\) firmware • hikvision ds-2cd2186g2-isu firmware • hikvision ds-2cd2326g2-isu\/sl firmware • hikvision ds-2cd2346g2-isu\/sl firmware • hikvision ds-2cd2366g2-i\(u\) firmware • hikvision ds-2cd2366g2-isu\/sl firmware • hikvision ds-2cd2386g2-i\(u\) firmware • hikvision ds-2cd2386g2-isu\/sl firmware • hikvision ds-2cd2426g2-i firmware • hikvision ds-2cd2446g2-i firmware • hikvision ds-2cd2526g2-i\(s\) firmware • hikvision ds-2cd2526g2-is firmware • hikvision ds-2cd2546g2-i\(s\) firmware • hikvision ds-2cd2566g2-i\(s\) firmware • hikvision ds-2cd2586g2-i\(s\) firmware • hikvision ds-2cd2626g2-izsu\/sl firmware • hikvision ds-2cd2646g2-izsu\/sl firmware • hikvision ds-2cd2666g2-izs firmware • hikvision ds-2cd2666g2-izsu\/sl firmware • hikvision ds-2cd2686g2-izs firmware • hikvision ds-2cd2686g2-izsu\/sl firmware • hikvision ds-2cd2766g2-izs firmware • hikvision ds-2cd2786g2-izs firmware • hikvision ds-2cd2027g2-l\(u\) firmware • hikvision ds-2cd2047g2-l\(u\) firmware • hikvision ds-2cd2027g2-lu\/sl firmware • hikvision ds-2cd2087g2-l\(u\) firmware • hikvision ds-2cd2127g2-\(-su\) firmware • hikvision ds-2cd2147g2-l\(su\) firmware • hikvision ds-2cd2327g2-l\(u\) firmware • hikvision ds-2cd2347g2-l\(u\) firmware • hikvision ds-2cd2347g2-lsu\/sl firmware • hikvision ds-2cd2387g2-l\(u\) firmware • hikvision ds-2cd2527g2-ls firmware • hikvision ds-2cd2547g2-ls firmware • hikvision ds-2cd2547g2-lzs firmware • hikvision ds-2cd2121g0-i\(w\)\(s\) firmware • hikvision ds-2cd2321g0-i\/nf firmware • hikvision ds-2cd2421g0-i\(d\)\(w\) firmware • hikvision ds-2cd2421g0-i\(d\)w firmware • hikvision ds-2cd2621g0-i\(z\)\(s\) firmware • hikvision ds-2cd2721g0-i\(z\)\(s\) firmware • hikvision ds-2cd2121g1-i\(w\) firmware • hikvision ds-2cd2121g1 firmware • hikvision ds-2cd2121g1-idw firmware • hikvision ds-2cd2023g2-i\(u\) firmware • hikvision ds-2cd2043g2-i\(u\) firmware • hikvision ds-2cd2063g2-i\(u\) firmware • hikvision ds-2cd2083g2-i\(u\) firmware • hikvision ds-2cd2123g2-i\(s\) firmware • hikvision ds-2cd2123g2-iu firmware • hikvision ds-2cd2143g2-i\(s\) firmware • hikvision ds-2cd2143g2-iu firmware … and 196 more

Related

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References