ACTIVELY EXPLOITED
CVE-2021-36260: Hikvision Improper Input Validation
| Vendor | Hikvision |
|---|---|
| Product | Security cameras web server |
| Actively exploited | Yes |
| Added to CISA KEV | 10 Jan 2022 |
| CISA federal deadline | 24 Jan 2022 |
| Weakness (CWE) | CWE-78 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation.
SOURCES
Other Hikvision flaws
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.