CVE-2021-36260VulnerabilityPublished 01/10/2022Updated 10/24/2026

CVE-2021-36260: Hikvision Improper Input Validation

Affects Hikvision Security cameras web serverSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 01/10/2022
KEV deadline: 01/24/2022
EPSS: 99.9% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2021-36260 (opens in a new tab)

Description

CVE-2021-36260 is a command injection vulnerability affecting the web server component of certain Hikvision security cameras. The flaw arises from insufficient input validation, allowing attackers to execute arbitrary commands on the affected device. This vulnerability has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information is provided in the available data.

Summary

This vulnerability involves improper input validation in the web server of some Hikvision security cameras, leading to command injection (CWE-78). An attacker can exploit this weakness to execute arbitrary commands on the device remotely. The vulnerability is tracked as CVE-2021-36260 and has been confirmed as exploited in the wild. No vendor advisory or patch details are included in the provided information.

Impact

Successful exploitation allows remote attackers to execute arbitrary commands on affected Hikvision security cameras, potentially leading to full device compromise. This can impact device confidentiality, integrity, and availability. The presence of known exploitation in the wild elevates the risk to deployed devices.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected devices, especially from untrusted networks, to reduce exposure.

Weaknesses

CWE-78OS Command Injection (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:56:50 UTC

Weaknesses

References

Related threats