CVE-2021-36260

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.

• CWE-78
• CWE-78

• https://packetstormsecurity.com/files/164603/Hikvision-Web-Server-Build-210702-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
• https://packetstormsecurity.com/files/166167/Hikvision-IP-Camera-Unauthenticated-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
• https://therecord.media/experts-warn-of-widespread-exploitation-involving-hikvision-cameras/Third Party Advisory
• https://www.cyfirma.com/wp-content/uploads/2022/08/HikvisionSurveillanceCamerasVulnerabilities.pdfBroken Link, Exploit, Third Party Advisory
• https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification-command-injection-vulnerability-in-some-hikvision-products/Vendor Advisory
• https://packetstormsecurity.com/files/164603/Hikvision-Web-Server-Build-210702-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
• https://packetstormsecurity.com/files/166167/Hikvision-IP-Camera-Unauthenticated-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
• https://therecord.media/experts-warn-of-widespread-exploitation-involving-hikvision-cameras/Third Party Advisory
• https://www.cyfirma.com/wp-content/uploads/2022/08/HikvisionSurveillanceCamerasVulnerabilities.pdfBroken Link, Exploit, Third Party Advisory
• https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification-command-injection-vulnerability-in-some-hikvision-products/Vendor Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-36260US Government Resource

Published

Sep 22, 2021

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-36233The function AdminGetFirstFileContentByFilePath in MIK.starl…6.5
• CVE-2021-36234Use of a hard-coded cryptographic key in MIK.starlight 7.9.5…5.5
• CVE-2021-36235An issue was discovered in Ivanti Workspace Control before 1…7.8
• CVE-2021-3624There is an integer overflow vulnerability in dcraw. When th…7.8
• CVE-2021-3625Buffer overflow in Zephyr USB DFU DNLOAD. Zephyr versions >=…9.8
• CVE-2021-3626The Windows version of Multipass before 1.7.0 allowed any lo…8.8
• CVE-2021-3627Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-36276Dell DBUtilDrv2.sys driver (versions 2.5 and 2.6) contains a…7.8
• CVE-2021-36277Dell Command | Update, Dell Update, and Alienware Update ver…7.8
• CVE-2021-36278Dell EMC PowerScale OneFS versions 8.2.x, 9.1.0.x, and 9.1.1…5.5
• CVE-2021-36279Dell EMC PowerScale OneFS versions 8.2.x - 9.2.x contain an …7.8
• CVE-2021-3628OpenKM Community Edition in its 6.3.10 version is vulnerable…5.4