CVE-2021-36260: Hikvision Improper Input Validation

Source: CISA Known Exploited Vulnerabilities catalog · back to feed

Vendor / product

Hikvision · Security cameras web server

Date added (KEV): Jan 10, 2022
CISA due date: Jan 24, 2022
Ransomware campaign use: Unknown

Required action

Apply updates per vendor instructions.

Vendor fix: Vendor advisory

Scorifya interpretation

AI-generated

A short, structured read of the record above, generated when this page first loads, then cached for a week.

Plain English

Technical detail

From CISA

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation.

https://nvd.nist.gov/vuln/detail/CVE-2021-36260

See what attackers can see on your domain

This vulnerability is on CISA's Known Exploited Vulnerabilities list, so it is being exploited in the wild right now. Scorifya can't test for Hikvision directly, but in about 30 seconds it shows what your own domain exposes publicly across TLS, security headers, DNS, and cookies: the surface attackers probe first.

Run a free scan Methodology

SOC 2 compliance

Tracking remediation across your cloud infrastructure?

Scorifya Controls automates 54 SOC 2 checks across AWS, GitHub, GCP, and Azure, and gives you a manual evidence trail for the controls no tool can automate. Self-hosted, three tiers from $99/mo.

See Scorifya Controls →

References

Other recent CVEs from Hikvision

CVE-2017-7921Multiple Products, Hikvision Multiple Products Improper Authentication Vulnerability