CVE-2021-36260

Published Sep 22, 2021

Last updated 2 years ago

Overview

Description
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.
Source
hsrc@hikvision.com
NVD status
Analyzed

Risk scores

CVSS 3.1

Type
Primary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

CVSS 2.0

Type
Primary
Base score
9.3
Impact score
10
Exploitability score
8.6
Vector string
AV:N/AC:M/Au:N/C:C/I:C/A:C

Known exploits

Data from CISA

Vulnerability name
Hikvision Improper Input Validation
Exploit added on
Jan 10, 2022
Exploit action due
Jan 24, 2022
Required action
Apply updates per vendor instructions.

Weaknesses

nvd@nist.gov
CWE-78

Social media

Hype score
Not currently trending

Configurations