← Vulnerability feed

Vulnerability record · CVE-2021-36260 · published 22 September 2021

CVE-2021-36260: Hikvision camera web server OS command injection

Hikvision · Ds 2cd2026g2 Iu\/Sl Firmware

The web server in several Hikvision products fails to validate input, allowing an attacker to inject OS commands via crafted messages. This is a critical, remotely reachable flaw in internet-facing cameras and similar devices. It matters because such devices are widely deployed and often left unpatched.

9.8 CVSS 3.1 Critical CISA KEV since 10 Jan 2022 EPSS 100% · top 0.1% CWE-78 · OS command injection
9.8CVSS 3.1 base score, v2 9.3
100%EPSS exploitation probability, 30 days
YesIn CISA KEV, fix deadline passed
150Affected product versions listed by NVD
11References, 6 tagged exploit
17 Jun 2026Last modified by NVD

Description

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, active exploitation in the wild (KEV), and near-certain exploitation likelihood (EPSS >99%) make this an urgent risk.

What it is

The web server in several Hikvision products fails to validate input, allowing an attacker to inject OS commands via crafted messages. This is a critical, remotely reachable flaw in internet-facing cameras and similar devices. It matters because such devices are widely deployed and often left unpatched.

Impact

An attacker can execute arbitrary commands on the device, gaining full control over the camera and potentially pivoting into the network. This can lead to data theft, surveillance manipulation, or use as a foothold.

Attack surface

The vulnerability is in the web server and is reachable over the network without authentication or user interaction, as indicated by the CVSS vector (AV:N/PR:N/UI:N).

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2022-01-10, and public exploit references exist; EPSS probability is 0.99869 (99.9th percentile), indicating very high likelihood of exploitation.

What to do

  • Apply the vendor's security updates as instructed in Hikvision's advisory.
  • If patching is not immediately possible, isolate affected devices on a separate network segment and restrict access to the web interface.
  • Disable or block external access to the device web server until patched.
  • Monitor vendor communications for updated firmware and apply promptly.

Detection

  • Monitor web server logs for unusual HTTP requests containing command injection patterns (e.g., shell metacharacters).
  • Use network monitoring to detect anomalous outbound connections from camera devices.
  • Check for unexpected processes or files on the device if access is available.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Exploitation in the wild

CISA added CVE-2021-36260 to the Known Exploited Vulnerabilities catalog on 10 January 2022 as "Hikvision Improper Input Validation". Required action: Apply updates per vendor instructions. Federal deadline 24 January 2022.

Affected products

150 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://packetstormsecurity.com/files/164603/Hikvision-Web-Server-Build-210702-Command-Injection.html ExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/166167/Hikvision-IP-Camera-Unauthenticated-Command-Injection.html ExploitThird Party AdvisoryVDB Entry
https://therecord.media/experts-warn-of-widespread-exploitation-involving-hikvision-cameras/ Third Party Advisory
https://www.cyfirma.com/wp-content/uploads/2022/08/HikvisionSurveillanceCamerasVulnerabilities.pdf Broken LinkExploitThird Party Advisory
https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification-command-injection-vulnerabili Vendor Advisory
http://packetstormsecurity.com/files/164603/Hikvision-Web-Server-Build-210702-Command-Injection.html ExploitThird Party AdvisoryVDB Entry
http://packetstormsecurity.com/files/166167/Hikvision-IP-Camera-Unauthenticated-Command-Injection.html ExploitThird Party AdvisoryVDB Entry
https://therecord.media/experts-warn-of-widespread-exploitation-involving-hikvision-cameras/ Third Party Advisory
https://www.cyfirma.com/wp-content/uploads/2022/08/HikvisionSurveillanceCamerasVulnerabilities.pdf Broken LinkExploitThird Party Advisory
https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification-command-injection-vulnerabili Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-36260 US Government Resource

Track CVE-2021-36260 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2026-53266Linux kernel ebtables SNAT out-of-bounds write in ARP rewriteThe ebtables SNAT target rewrites the ARP sender hardware address via skb_store_bits() without first making that range writable. When the ARP SHA byt…KEVEPSS 0.65%analysed8.8CVE-2026-87491Google Chrome V8 out-of-bounds write enables sandbox code executionChrome before 153.0.8010.36 contains an out-of-bounds write in the V8 JavaScript engine. A crafted HTML page can trigger the memory corruption, and b…KEVEPSS 3.1%analysed9.8CVE-2025-25249Fortinet FortiOS and FortiSwitchManager heap buffer overflow via crafted packetsA heap-based buffer overflow (CWE-122/CWE-787) in Fortinet FortiOS 6.4 through 7.6.3 and FortiSwitchManager 7.0 through 7.2.6 lets an unauthenticated…KEVEPSS 3.9%analysed7.8CVE-2026-83549SonicWall SMA1000 AMC OS Command InjectionThe SMA1000 Appliance Management Console contains an OS command injection flaw (CWE-78) that lets an authenticated administrator execute arbitrary op…KEVEPSS 11%analysed10.0CVE-2026-49869Kestra OSS auth bypass via path suffix match enables RCEKestra OSS AuthenticationFilter whitelists the public config endpoint using request.getPath().endsWith("/configs"), a suffix match instead of an exac…KEVEPSS 2.1%analysed7.8CVE-2026-53362Linux kernel IPv6 UDP paged allocation out-of-bounds write__ip6_append_data() in the Linux kernel mis-accounts fraggap on the paged-allocation path, leaving the linear skb area undersized while pagedlen is o…KEVEPSS 0.71%analysed7.8CVE-2022-0995Linux kernel watch_queue out-of-bounds writeThe Linux kernel's watch_queue event notification subsystem contains an out-of-bounds write (CWE-787) that can overwrite kernel state. A local user c…KEVEPSS 8.8%analysed8.9CVE-2026-73570Zimbra Collaboration SNMP notification OS command injectionZimbra Collaboration Suite before 10.1.20 contains an OS command injection flaw in SNMP notification processing when the optional zimbra-snmp package…KEVEPSS 12%analysed

Source: NIST National Vulnerability Database (record CVE-2021-36260), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.