# CVE-2021-36260: Hikvision - RCE

> Live exploitation tracking for CVE-2021-36260 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2021-36260

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Hikvision DS-2cd2026g2-I
- **Weaknesses:** CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
- **Tags:** iot, web_server

## Description

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.

## CrowdSec analysis

[CVE-2021-36260](https://euvd.enisa.europa.eu/vulnerability/CVE-2021-36260) is a critical command injection vulnerability affecting the web server of certain Hikvision products. Insufficient input validation allows remote attackers to execute arbitrary commands by sending specially crafted messages, potentially leading to full system compromise. This vulnerability can be exploited without authentication, making it a prime target for remote code execution attacks.

CrowdSec has been tracking this vulnerability and its exploits since 11th of September 2025.

CrowdSec network data shows that most actors exploiting CVE-2021-36260 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature.
Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2021-36260 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2021-36260 is currently experiencing high visibility and active exploitation across the internet.

Attackers exploit this vulnerability by sending crafted PUT requests to the `/SDK/webLanguage` endpoint, injecting malicious commands within XML payloads to achieve remote command execution on Hikvision devices. Subsequent GET requests to the injected file path (e.g., `/x`) are used to verify successful exploitation.

## Timeline

- 2021-09-22: CVE Published. CVE-2021-36260 is published to NVD.
- 2022-01-10: CISA KEV. CVE-2021-36260 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2022-01-24: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2025-09-11: Rule Released. CrowdSec releases a rule to detect CVE-2021-36260 exploitation attempts against the CrowdSec Network.
- 2025-09-12: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2021-36260 for the first time.

## References

- https://therecord.media/experts-warn-of-widespread-exploitation-involving-hikvision-cameras/
- https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification-command-injection-vulnerability-in-some-hikvision-products/
- http://packetstormsecurity.com/files/166167/Hikvision-IP-Camera-Unauthenticated-Command-Injection.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-36260
- http://packetstormsecurity.com/files/164603/Hikvision-Web-Server-Build-210702-Command-Injection.html
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-36260.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2021-36260) follows observed exploitation activity for CVE-2021-36260. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.