PT-2021-4746 · Hikvision · Hikvision Nvr+1

Published 2021-09-21 · Updated 2026-05-02 · CVE-2021-36260

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Hikvision products (affected versions not specified)

Description A command injection issue exists in the web server of certain Hikvision products due to insufficient input validation. A remote attacker can exploit this by sending specially crafted messages containing malicious commands to the HTTP(S) server ports (typically 80 or 443), specifically targeting the language parameter. This allows for zero-click remote code execution, enabling the attacker to obtain root access and full control over the device. Compromised devices can be used to access internal networks or be recruited into botnets, such as Mirai-based variants like Moobot, to launch DDoS attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-20

CWE-77

Related Identifiers

BDU:2021-05455

CVE-2021-36260

Affected Products

Hikvision Ip Camera

Hikvision Nvr

References · 66

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/hikvision_cve_2021_36260_blind.rb · Exploit
• 🔥 https://github.com/Aiminsun/CVE-2021-36260 · Exploit
• 🔥 https://github.com/Cuerz/CVE-2021-36260 · Exploit
• 🔥 https://github.com/TaroballzChen/CVE-2021-36260-metasploit · Exploit
• 🔥 https://github.com/rabbitsafe/CVE-2021-36260 · Exploit
• 🔥 https://github.com/tuntin9x/CheckHKRCE · Exploit
• 🔥 https://github.com/r3t4k3r/hikvision_brute · Exploit
• 🔥 https://cyfirma.com/wp-content/uploads/2022/08/HikvisionSurveillanceCamerasVulnerabilities.pdf · Exploit
• 🔥 https://packetstormsecurity.com/files/164603/Hikvision-Web-Server-Build-210702-Command-Injection.html · Exploit
• 🔥 http://packetstormsecurity.com/files/164603/Hikvision-Web-Server-Build-210702-Command-Injection.html · Exploit
• 🔥 https://exploit-db.com/exploits/50441 · Exploit
• 🔥 http://packetstormsecurity.com/files/166167/Hikvision-IP-Camera-Unauthenticated-Command-Injection.html · Exploit
• https://safe-surf.ru/upload/VULN/VULN-20210922.3.pdf · Security Note
• https://hikvision.com/en/support/cybersecurity/security-advisory/security-notification-command-injection-vulnerability-in-some-hikvision-products · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05455 · Security Note