CVE-2021-36260

What it actually does

CVE-2021-36260 is an unauthenticated remote command injection vulnerability in the embedded web server of multiple Hikvision camera firmware versions. Insufficient validation of user-supplied input allows an attacker to send a crafted HTTP request containing operating-system commands that are executed by the device with the privileges of the web server process, often sufficient to alter configuration, retrieve sensitive data, install tooling, pivot into adjacent networks, disrupt video services, or fully compromise the device. The vulnerability is network-exploitable, requires no credentials or user interaction, and has a CVSS score of 9.8 with a very high EPSS probability, indicating broad attacker interest and reliable exploitation in the wild.

Why it matters to the business

Successful exploitation can result in loss of confidentiality, integrity, and availability of affected surveillance devices. Organizations may lose camera visibility, have video feeds or credentials exposed, have devices enrolled into botnets, or have compromised cameras used as internal footholds for reconnaissance and lateral movement. Because this vulnerability is listed in CISA KEV, has been actively exploited for years, and had a CISA remediation deadline of 2022-01-24, any remaining exposed or unpatched devices should be treated as high-risk legacy exposure requiring urgent remediation.

How an attack unfolds

An attacker first discovers an exposed Hikvision device by scanning for characteristic web interfaces or services. They then send a specially crafted HTTP request to the vulnerable web server, commonly targeting the language configuration functionality and embedding shell metacharacters or command substitution syntax in the request body. Because the firmware does not properly validate the supplied value before passing it to an operating-system command context, the injected command runs on the device. The attacker may begin with a benign command such as id, uname, wget, curl, tftp, or busybox to confirm execution, then retrieve additional payloads, create persistence where possible, modify device settings, disable logging, add the device to a botnet, or use the camera as a staging point for further activity. Public exploitation and automated scanning have been observed, and threat reporting associates exploitation activity with StrikeShark and broader Hikvision-targeting campaigns.

How to fix it

Upgrade affected Hikvision devices to the latest vendor-supplied firmware that remediates CVE-2021-36260. Because no exact fixed versions were provided in the input, validate each device model and firmware branch against Hikvision security advisories and obtain firmware directly from the vendor or an authorized support channel. If immediate patching is not possible, remove device management interfaces from the public internet, restrict access to trusted management networks or VPNs, block inbound access to HTTP/HTTPS management ports from untrusted sources, disable unnecessary services, rotate device credentials, and monitor for command-execution attempts. For devices that cannot receive fixed firmware, replace them or place them behind strict network controls. Any device that was internet-exposed while vulnerable should be treated as potentially compromised and should be reimaged, factory reset after firmware upgrade, or replaced where feasible.

How to confirm the fix worked

Confirm exposure by inventorying Hikvision devices, recording model and firmware versions, and comparing them with Hikvision advisories for this vulnerability. Validate externally that management interfaces are not reachable from the public internet and internally that only approved administration networks can access them. Confirm remediation by checking the installed firmware version after upgrade and by testing that known exploit probes against the vulnerable endpoint no longer result in command execution. Use non-destructive validation only; for example, verify that crafted requests are rejected or sanitized rather than executing diagnostic commands. Review network access-control rules to ensure HTTP/HTTPS management ports are blocked from untrusted networks, and verify that SIEM or network detection content is alerting on known exploit patterns such as suspicious requests to /SDK/webLanguage containing shell metacharacters.

Typical attack path

1. Scan the internet or internal networks for Hikvision camera web interfaces and matching firmware families.
2. Probe the web server for vulnerable endpoints, commonly including language or SDK-related paths.
3. Send a crafted unauthenticated HTTP request containing shell metacharacters or command substitution payloads.
4. Confirm remote command execution using simple commands such as id, uname, whoami, ping, wget, curl, tftp, or busybox.
5. Download or execute a follow-on payload, such as a botnet implant, reverse shell, credential theft script, or reconnaissance tool.
6. Modify configuration, create persistence if supported, disrupt services, or use the compromised device as an internal foothold.
7. Cover tracks by clearing logs, rebooting the device, or blending subsequent traffic with normal device management activity.

How to detect it

Investigate whether exploitation already occurred by reviewing device web server logs if available, upstream reverse proxy logs, firewall logs, IDS/IPS alerts, NetFlow, DNS logs, and EDR/NDR telemetry that observes camera network behavior. Focus on unauthenticated HTTP requests to Hikvision SDK or language endpoints, especially PUT or POST requests to /SDK/webLanguage with XML bodies containing shell metacharacters such as $, $(), backticks, semicolons, pipes, ampersands, or commands like wget, curl, tftp, busybox, chmod, sh, nc, telnetd, id, uname, or cat. Look for successful outbound connections from camera IPs to unfamiliar external hosts shortly after suspicious HTTP requests, especially payload retrieval over HTTP, TFTP, FTP, or raw TCP. Review DNS for unusual domains resolved by camera devices and firewall logs for scanning behavior originating from cameras after the suspected compromise time. On the device, where forensic access is possible, look for modified startup scripts, unexpected binaries in writable temporary paths, changed user accounts or passwords, altered NTP/DNS settings, disabled logging, unexpected reboots, and configuration changes not attributable to administrators. Because embedded camera logs may be limited or overwritten after reboot, prioritize upstream network telemetry and compare against known exploitation windows and threat-actor activity such as StrikeShark or automated Hikvision exploitation campaigns.

• /SDK/webLanguage
• PUT /SDK/webLanguage
• POST /SDK/webLanguage
• <language>$(id)</language>
• <language>$(whoami)</language>
• <language>$(uname
• <language>`id`</language>
• <language>`whoami`</language>
• <language>`uname
• $(wget
• $(curl
• $(tftp
• $(busybox
• $(chmod +x
• $(/bin/sh
• $(sh -c
• $(nc
• $(telnetd
• ;wget
• ;curl
• ;tftp
• |wget
• |curl
• |tftp
• `wget
• `curl
• `tftp
• /davinci
• /tmp/
• /var/tmp/
• /mnt/mtd/
• busybox wget
• busybox tftp
• chmod 777
• chmod +x
• User-Agent: python-requests
• User-Agent: Go-http-client
• User-Agent: curl
• Hikvision CVE-2021-36260
• webLanguage command injection

What your security team should do

• Immediately identify all Hikvision cameras and appliances, prioritizing internet-facing devices and devices reachable from user or server networks.
• Patch affected devices to vendor-fixed firmware or replace unsupported devices; treat unpatched exposed devices as critical risk because the vulnerability is in CISA KEV and has a very high EPSS score.
• Remove management interfaces from the internet and require VPN, jump host, or dedicated management network access.
• Hunt historical web, firewall, proxy, IDS, and NetFlow logs for exploit attempts, especially requests to /SDK/webLanguage containing command-substitution syntax or downloads of external payloads.
• Assume compromise for devices that were publicly exposed while vulnerable; preserve evidence where needed, then factory reset, upgrade firmware, rotate credentials, and review downstream access.
• Add network segmentation rules preventing cameras from initiating arbitrary outbound connections except to approved management, NVR, DNS, and time services.
• Deploy IDS/WAF signatures for Hikvision command-injection attempts, including shell metacharacters in SDK-related HTTP requests.
• Monitor for abnormal outbound traffic from cameras, including connections to unknown IPs, high-volume scanning, IRC/Telnet-like behavior, wget/curl/tftp payload retrieval, or unexpected DNS lookups.
• Document Hikvision firmware baselines and add these devices to recurring vulnerability and asset-management workflows.