CVE-2021-36260

This vulnerability is like a “back door” in the camera’s web interface. If someone can reach that interface from the network, they may be able to trick the camera into running commands chosen by the attacker—similar to sending the device a disguised message that makes it execute instructions instead of handling the message safely. In practice, this can lead to the camera being taken over or being used to harm your network.

This matters if your business uses Hikvision cameras with the listed affected firmware versions in their web server. It is dangerous specifically because it does not require a login, and it does not require you to click anything—an attacker only needs network access to the camera’s web server. Because the reachable-from-internet condition is not confirmed in the findings, treat it as a risk when your cameras are reachable from the internet (or from an untrusted network) via the web server.

This is RED because attackers can execute arbitrary commands on affected Hikvision devices, and CISA added this issue to its Known Exploited Vulnerabilities list. Public exploitation is also supported by multiple public exploits, so the window for attackers to use it is already open. Act immediately to block exposure and apply Hikvision updates per their advisory.

1. Identify exposure first

• Determine whether any of your Hikvision cameras (with the affected firmware listed for CVE-2021-36260) are reachable from outside your local network.
• Concretely check whether you have port-forwarding, UPnP, or firewall rules that allow internet-to-camera web access.

2. Confirm the affected firmware is in use

• On each camera, check the firmware/version details.
• Compare against the affected firmware items provided for CVE-2021-36260. If your firmware matches one of the listed affected firmware versions, you should treat the device as vulnerable until updated.

3. Apply the vendor fix

• Follow Hikvision’s remediation steps from their advisory for “Command Injection Vulnerability in Some Hikvision Products.”
• Update each affected camera according to the vendor instructions (including any required reboot/process steps after updating).

4. Compensating controls if you can’t patch immediately

• Block external access to the camera web server right away.
• Restrict access to trusted networks only (for example, allow access only via a VPN or from your internal management network).

5. Verification

• After patching, re-check camera reachability rules to ensure the web server is not exposed to untrusted networks.
• Confirm the camera reports the updated firmware state per the vendor’s update process.

6. Timing note from KEV

• CISA’s remediation due date for this KEV entry was 2022-01-24.

7. What to monitor

• Monitor firewall logs for inbound attempts to the camera web service.
• Review camera/system logs (if available) for signs of abnormal command execution attempts during the period before patching.

Severity: Critical (command injection) with high impact described in the findings (arbitrary command execution, network-based, no authentication, no user interaction).

Mechanism: CWE-78 command injection in the Hikvision web server. The vulnerability is triggered by specially crafted network messages sent to the web server, which allows arbitrary commands to run on the device.

Reachability/authentication: None required (unauthenticated, PR:N; UI:N). Network-based exploitation is implied (AV:N). Whether the default configuration exposes the web server publicly is unknown in the findings, so exposure depends on whether the web server is reachable from an attacker-controlled network.

Exploitation status: CISA KEV listing confirms real-world exploitation (listed 2022-01-10; remediation due 2022-01-24). Public exploit availability is also noted (3 known).

EPSS: A prediction is provided (99.9th percentile, rising), but public KEV confirmation is the primary basis for urgency.

Exploit maturity: Weaponized with publicly available exploits, consistent with fast attacker use once reachable.