What is CVE-2021-36260?

CVE-2021-36260 is a critical command injection vulnerability in some Hikvision products' web servers, including various network cameras and recorders. Attackers can exploit this vulnerability by sending messages with malicious commands due to insufficient input validation.

Who is impacted by CVE-2021-36260?

CVE-2021-36260 affects users of certain Hikvision products, including various network cameras and recorders. This vulnerability impacts over 2,300 organizations in more than 100 countries. It affects models with firmware versions from 4.30.210 up to 4.31.000 and Hikvision Web Server Build 210702.

What to do if CVE-2021-36260 affected you

If you're affected by the CVE-2021-36260 vulnerability, it's crucial to take action to protect your systems. Here are some simple steps to follow:

1. Update your Hikvision product's firmware to the latest version, as the company released a patch in September 2021.

2. Regularly check for and apply any available security patches.

3. Monitor your network for any suspicious activity or unauthorized access.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2021-36260 vulnerability is indeed listed in CISA's Known Exploited Vulnerabilities Catalog. It is named "Hikvision Improper Input Validation" and was added on January 10, 2022. The due date for required action is January 24, 2022, and organizations are advised to apply updates according to vendor instructions. In simple terms, this vulnerability allows attackers to exploit Hikvision cameras by injecting malicious commands, potentially gaining access to the devices and further compromising an organization's environment.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-78, which involves improper neutralization of special elements used in an OS command, also known as OS command injection.

Learn More

For a comprehensive understanding of the vulnerability, its impact, and mitigation strategies, refer to the NVD page and the sources listed below.

• Packet Storm: Hikvision Web Server Build 210702 Command Injection

• The Record: Experts warn of widespread exploitation involving Hikvision cameras