CVE-2021-36260 is a critical command injection vulnerability in Hikvision surveillance cameras disclosed in late 2021. It received a CVSS score of 9.8, indicating critical severity. The flaw allows remote attackers to execute arbitrary commands on affected devices. Despite the availability of patches, over 80,000 devices remain vulnerable globally due to difficulties in patch deployment and poor security practices such as default passwords. Cybercriminals have been observed selling access to these compromised cameras on Russian dark web forums. The vulnerability affects a broad range of Hikvision cameras used worldwide, including in the United States. The vendor has not demonstrated significant improvements in security posture or update mechanisms for these IoT devices.

The vulnerability enables remote command injection on affected Hikvision cameras, potentially allowing attackers to take control of the devices. This exposure risks unauthorized surveillance, privacy breaches, and could serve as a foothold for further network compromise. The large number of unpatched devices increases the attack surface and facilitates cybercriminal activity, including the sale of access credentials. Although no confirmed active exploitation is reported, the presence of threat actors discussing and trading access indicates a credible threat. The impact is significant given the critical severity and widespread deployment of these devices.

Patch status is not yet confirmed from the provided data; users should consult Hikvision's official advisories for current remediation guidance. Users are strongly advised to apply any available firmware updates addressing CVE-2021-36260. Additionally, changing default passwords and disabling unnecessary remote access features can reduce exposure. Due to the challenges in automatic updates for IoT devices, organizations should verify device security configurations and monitor for unauthorized access. No vendor advisory content was provided to confirm patch availability or official fixes.