Skip to content
Sign in

Hikvision product

Security cameras web server

Alert
No CISA KEV deadline is open. CISA last added a Security cameras web server CVE on 10 Jan 2022.

Tracked since 4 Mar · latest article 27 Oct · RSS · API

0Open KEV deadlines

None open

0Added to KEV · 90 days

of 1 in the full CISA catalogue · all time

0High exploit odds · current

EPSS top 5%, not in KEV

1Articles · 7 days

usual rate

Exploited, by due date1

Security cameras web server CVEs in CISA KEV with their federal deadlines. None is open.

Exploited Security cameras web server CVEs
CVEProductAddedFederal deadlineArticles
In CISA KEVCVE-2021-36260Security cameras web server10 JanPassed 24 Jan4
CSV of 1 entries

Patch cadence and exploit odds

How often CISA adds Security cameras web server CVEs, how many have a fix, and where their exploit odds sit.

Added to CISA KEV per quarter

0Q1 ’250Q2 ’250Q3 ’250Q4 ’250Q1 ’260Q2 ’260Q3 ’260Q4 ’26
Show as table
Added to CISA KEV per quarter
QuarterAdded
Q1 20250
Q2 20250
Q3 20250
Q4 20250
Q1 20260
Q2 20260
Q3 20260
Q4 20260

No additions in the last eight quarters.

Fix listed

0 of 1 CVE in coverage

1 CVE has no vendor fix recorded yet.

EPSS percentile of each CVE

One dot per CVE; a red diamond marks those in CISA KEV.

top 5%CVE-2021-36260: 100th percentile, in CISA KEV050100
Show as table
FIRST EPSS percentiles across CVEs in coverage
CVEEPSS percentile
CVE-2021-36260100

Coverage4 articles · all time

The latest 4 articles naming Security cameras web server, in the shared story grammar.

Full timeline
Developinglatest 4 hours ago4 articles4 outlets

4 articles from 4 outlets since 4 Mar. Picked up again today after 33 weeks quiet.

Now4 Mar4567891025 OctFirst reportCheck Point · 4 Mar, 03:57Picked up againafter 2 days quiet
  • Wed 4 Mar, 03:57 UTC. Check Point, first report. Iranian actors exploit Hikvision and Dahua IP cameras via CVEs. Cites a CVE in CISA KEV.
  • Fri 6 Mar, 14:34 UTC. Dark Reading, its first report on the story. Iran weaponises cameras with CVEs to plan missile strikes. Cites a CVE in CISA KEV.
  • Sat 7 Mar, 10:55 UTC. Security Affairs, its first report on the story. Iran-linked actors scan Hikvision and Dahua cams via VPN for CVEs. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 07:30 UTC. The Hacker News, its first report on the story. CERT-UA reports attacks on Dahua cameras in Ukraine. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 4 articles as a list
  1. Wed 4 MarDay 01
    1. Iranian actors exploit Hikvision and Dahua IP cameras via CVEs03:57 · Check Point · First report · Exploited CVE · Known exploited CVE

  2. Quiet for 2 days

    Fri 6 MarDay 21
    1. Iran weaponises cameras with CVEs to plan missile strikes14:34 · Dark Reading · Picked up again · Known exploited CVE
  3. Sat 7 MarDay 31
    1. Iran-linked actors scan Hikvision and Dahua cams via VPN for CVEs10:55 · Security Affairs · Known exploited CVE

  4. Quiet for 33 weeks

    Tue 27 OctDay 2371
    1. CERT-UA reports attacks on Dahua cameras in Ukraine07:30 · The Hacker News · Picked up again · Known exploited CVE

All CVEs in coverage1

Exploited first, then by EPSS

In the CVE tracker
  • CVE-2021-36260Exploited

    Hikvision Improper Input Validation

    Not scored99.8% EPSS · 4 articles
CyberSIXTSignal over noise
Updated AboutDevelopersSign in