Vulnerability Details : CVE-2021-36260

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.
Published 2021-09-22 13:15:08
Updated 2022-10-27 21:18:55
View at NVD,
At least one public exploit which can be used to exploit this vulnerability exists!
CVE-2021-36260 is in the CISA Known Exploited Vulnerabilities Catalog
CISA vulnerability name:
Hikvision Improper Input Validation
CISA required action:
Apply updates per vendor instructions.
CISA description:
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation.
Added on 2022-01-10 Action due date 2022-01-24

Exploit prediction scoring system (EPSS) score for CVE-2021-36260

Probability of exploitation activity in the next 30 days: 97.51%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 100 % EPSS Score History EPSS FAQ

Metasploit modules for CVE-2021-36260

  • Hikvision IP Camera Unauthenticated Command Injection
    Disclosure Date : 2021-09-18
    This module exploits an unauthenticated command injection in a variety of Hikvision IP cameras (CVE-2021-36260). The module inserts a command into an XML payload used with an HTTP PUT request sent to the `/SDK/webLanguage` endpoint, resulting in command execution as the `root` user. This module specifically attempts to exploit the blind variant of the attack. The module was successfully tested against an HWI-B120-D/W using firmware V5.5.101 build 200408. It was also tested against an unaffected DS-2CD2142FWD-I using firmware V5.5.0 build 170725. Please see the Hikvision advisory for a full list of affected products. Authors: - Watchful_IP - bashis - jbaines-r7

CVSS scores for CVE-2021-36260

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Source
[email protected]
[email protected]

CWE ids for CVE-2021-36260

References for CVE-2021-36260

Products affected by CVE-2021-36260

Max 200 conditions are displayed on this page, to prevent potential performance issues, please refer to NVD for more details.
This web site uses cookies for managing your session and website analytics (Google analytics) purposes as described in our privacy policy.
By using this web site you are agreeing to terms of use!