CVE-2021-36260Not scored
Hikvision Improper Input Validation
Hikvision · Security cameras web server
Exploited in the wild · in CISA KEV since 10 Jan 2022
99.9%probability of exploitation in the next 30 days
99th percentile
050100
Higher than 99% of scored CVEs
Not scored yet. NVD has not published a CVSS score.
Federal deadline
CISA KEV · added 10 Jan · catalogue entry
Passed 1737 days ago
DescriptionNVD
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.
CISA required action
Apply updates per vendor instructions.
Coverage4 articles · 4 outlets
First in our coverage: Check Point, 4 Mar.
Developinglatest 21 hours ago4 articles4 outlets
- Wed 4 Mar, 03:57 UTC. Check Point, first report. Iranian actors exploit Hikvision and Dahua IP cameras via CVEs. Cites a CVE in CISA KEV.
- Fri 6 Mar, 14:34 UTC. Dark Reading, its first report on the story. Iran weaponises cameras with CVEs to plan missile strikes. Cites a CVE in CISA KEV.
- Sat 7 Mar, 10:55 UTC. Security Affairs, its first report on the story. Iran-linked actors scan Hikvision and Dahua cams via VPN for CVEs. Cites a CVE in CISA KEV.
- Tue 27 Oct, 07:30 UTC. The Hacker News, its first report on the story. CERT-UA reports attacks on Dahua cameras in Ukraine. Cites a CVE in CISA KEV.
- CERT-UA reports attacks on Dahua cameras in UkraineThe Hacker News · mentions it in passing
- Iran-linked actors scan Hikvision and Dahua cams via VPN for CVEsSecurity Affairs · mentions it in passing
- Iran weaponises cameras with CVEs to plan missile strikesDark Reading · mentions it in passing
- Iranian actors exploit Hikvision and Dahua IP cameras via CVEsCheck Point · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.