CVE-2021-36260

This vulnerability is like a “back door” in the camera’s web interface. If someone can reach that interface from the network, they may be able to trick the camera into running commands chosen by the attacker—similar to sending the device a disguised message that makes it execute instructions instead of handling the message safely. In practice, this can lead to the camera being taken over or being used to harm your network.

This matters if your business uses Hikvision cameras with the listed affected firmware versions in their web server. It is dangerous specifically because it does not require a login, and it does not require you to click anything—an attacker only needs network access to the camera’s web server. Because the reachable-from-internet condition is not confirmed in the findings, treat it as a risk when your cameras are reachable from the internet (or from an untrusted network) via the web server.

This is RED because attackers can execute arbitrary commands on affected Hikvision devices, and CISA added this issue to its Known Exploited Vulnerabilities list. Public exploitation is also supported by multiple public exploits, so the window for attackers to use it is already open. Act immediately to block exposure and apply Hikvision updates per their advisory.