PT-2021-4746 · Hikvision · Hikvision Nvr+1

Published 2021-09-21 · Updated 2026-03-29 · CVE-2021-36260

Positive Technologies · (AI Summary)

CVSS v2.0

10

Critical

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Hikvision IP camera/NVR firmware versions prior to the fixed version

Description The issue is related to insufficient input validation in the web server of some Hikvision products, allowing an attacker to launch a command injection attack by sending malicious commands. This can lead to full control over targeted devices and possibly internal networks. Over 3.2 million cameras are potentially exposed to this issue. The vulnerability has been exploited in the wild, with instances of botnets, such as Moobot, using it to spread and conduct DDoS attacks.

Recommendations For Hikvision IP camera/NVR firmware versions prior to the fixed version, update to the patched version (v210628) to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable web server or disabling the language parameter in the /SDK/webLanguage API endpoint until a patch is applied.

Exploit

Fix

RCE

Command Injection

OS Command Injection

Weakness Enumeration

CWE-20

CWE-77

CWE-78

Related Identifiers

BDU:2021-05455

CVE-2021-36260

Affected Products

Hikvision Ip Camera

Hikvision Nvr

References · 60

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/hikvision_cve_2021_36260_blind.rb · Exploit
• 🔥 https://github.com/Aiminsun/CVE-2021-36260 · Exploit
• 🔥 https://github.com/Cuerz/CVE-2021-36260 · Exploit
• 🔥 https://github.com/TaroballzChen/CVE-2021-36260-metasploit · Exploit
• 🔥 https://github.com/rabbitsafe/CVE-2021-36260 · Exploit
• 🔥 https://github.com/tuntin9x/CheckHKRCE · Exploit
• 🔥 https://github.com/r3t4k3r/hikvision_brute · Exploit
• 🔥 https://exploit-db.com/exploits/50441 · Exploit
• 🔥 https://cyfirma.com/wp-content/uploads/2022/08/HikvisionSurveillanceCamerasVulnerabilities.pdf · Exploit
• 🔥 https://packetstormsecurity.com/files/164603/Hikvision-Web-Server-Build-210702-Command-Injection.html · Exploit
• 🔥 http://packetstormsecurity.com/files/166167/Hikvision-IP-Camera-Unauthenticated-Command-Injection.html · Exploit
• 🔥 http://packetstormsecurity.com/files/164603/Hikvision-Web-Server-Build-210702-Command-Injection.html · Exploit
• https://bdu.fstec.ru/vul/2021-05455 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-36260 · Security Note
• https://hikvision.com/en/support/cybersecurity/security-advisory/security-notification-command-injection-vulnerability-in-some-hikvision-products · Vendor Advisory