CVE-2021-36260: Hikvision Improper Input Validation

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-01-10. EPSS: 99.9% chance of exploitation in the next 30 days.

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.

Affected products

  • Hikvision Ds-2cd2021g1-I(w) Firmware: affected versions not specified
  • Hikvision Ds-2cd2023g2-I(u) Firmware: affected versions not specified
  • Hikvision Ds-2cd2026g2-Iu/sl Firmware: affected versions not specified
  • Hikvision Ds-2cd2027g2-L(u) Firmware: affected versions not specified
  • Hikvision Ds-2cd2027g2-Lu/sl Firmware: affected versions not specified
  • Hikvision Ds-2cd2043g2-I(u) Firmware: affected versions not specified
  • Hikvision Ds-2cd2046g2-Iu/sl Firmware: affected versions not specified
  • Hikvision Ds-2cd2047g2-L(u) Firmware: affected versions not specified
  • Hikvision Ds-2cd2063g2-I(u) Firmware: affected versions not specified
  • Hikvision Ds-2cd2066g2-I(u) Firmware: affected versions not specified
  • Hikvision Ds-2cd2066g2-Iu/sl Firmware: affected versions not specified
  • Hikvision Ds-2cd2083g2-I(u) Firmware: affected versions not specified
  • Hikvision Ds-2cd2086g2-I(u) Firmware: affected versions not specified
  • Hikvision Ds-2cd2086g2-Iu/sl Firmware: affected versions not specified
  • Hikvision Ds-2cd2087g2-L(u) Firmware: affected versions not specified
  • Hikvision Ds-2cd2121g0-I(w)(s) Firmware: affected versions not specified
  • Hikvision Ds-2cd2121g1-I(w) Firmware: affected versions not specified
  • Hikvision Ds-2cd2121g1-Idw Firmware: affected versions not specified
  • Hikvision Ds-2cd2121g1 Firmware: affected versions not specified
  • Hikvision Ds-2cd2123g2-I(s) Firmware: affected versions not specified
  • Hikvision Ds-2cd2123g2-Iu Firmware: affected versions not specified
  • Hikvision Ds-2cd2127g2-(-Su) Firmware: affected versions not specified
  • Hikvision Ds-2cd2143g2-I(s) Firmware: affected versions not specified
  • Hikvision Ds-2cd2143g2-Iu Firmware: affected versions not specified
  • Hikvision Ds-2cd2147g2-L(su) Firmware: affected versions not specified
  • and 231 more

Published 2021-09-22. Last modified 2026-06-17.