Unauthenticated command injection

1. Summary

A command-injection defect in the embedded web server of a wide range of Hikvision IP cameras and network video recorders (NVRs) allows an unauthenticated attacker to run operating-system commands on the device. The web server fails to properly neutralize attacker-supplied input before passing it into a shell command context (CWE-78), so a single crafted HTTP(S) request to the device’s management interface (ports 80/443) yields code execution as root [1][5]. No credentials and no owner or operator interaction are required, and the resulting root shell grants more control than the device owner normally has — even the legitimate owner is confined to a restricted “protected shell” (psh) [5]. An attacker gains full control of the device: live and stored video, configuration, credentials, firmware, and the ability to persist.

2. Affected products & versions

Note: the full authoritative per-model affected/fixed matrix lives in Hikvision advisory HSRC-202109-01 [4]. NVD [1] lists a large model set but does not resolve every firmware boundary. Both primary sources that enumerate the flaw’s scope (NVD [1], Watchful IP [5]) describe it as affecting Hikvision IP cameras and NVRs, but neither enumerates NVR model or firmware boundaries. The NVR row above is therefore marked “not documented” rather than populated with inferred values; treat NVR scope as confirmed-affected-in-class but unenumerated pending HSRC-202109-01.

3. The vulnerability in detail

The flaw lives inside the HTTP/HTTPS web server that ships on Hikvision IP cameras and NVRs and listens by default on ports 80 and 443 [5]. This web server is the device’s primary management surface — it serves the configuration UI and an SDK-style API used by clients and integrations. The defect is a classic OS command injection: the server takes data received in an HTTP request and, without adequate validation or neutralization, passes it into a context where an operating-system shell interprets it. When that data contains shell metacharacters — specifically command-substitution syntax of the form $(...) — the shell evaluates the embedded command rather than treating it as inert text [1][7].

Root cause is a failure of input handling at a trust boundary: untrusted network input crosses directly into a shell command with insufficient sanitization (CWE-78, Improper Neutralization of Special Elements used in an OS Command) [1]. Mechanically, the server builds or invokes a shell command that includes attacker-controlled bytes. Because those bytes are not escaped or rejected, the attacker can break out of the intended data field and append or substitute their own command. The injected command inherits the privilege of the web server process. On these devices that process runs as root, so the injected command runs as root [5]. That privilege level is what distinguishes this from scoped API misuse: the same command context that a legitimate authenticated owner reaches only through a deliberately restricted “protected shell” (psh) is reached here directly, with no shell restriction and no authentication [5].

The publicly demonstrated injection point is the SDK web-language endpoint. Community detection and PoC tooling send a PUT /SDK/webLanguage request whose body is an XML document, and the injectable value rides inside the <language> element [7]. A representative body is:

<?xml version="1.0" encoding="UTF-8"?><language>$(echo <string>>webLib/x)</language>

Here the $(echo <string>>webLib/x) is not treated as a language string; the $(...) is executed by the device shell, writing a file into webLib/. The detection template then issues a GET /x and, if the file’s contents come back, execution is confirmed [7]. This is a safe, non-destructive verification pattern — but the same primitive generalizes to arbitrary commands, since any content placed inside the <language> element is evaluated by the same shell path.

Mechanism and preconditions: the only preconditions are (a) network reachability to the device web port (80/443) and (b) the device running affected, unpatched firmware [5]. There is no authentication requirement, no need for the operator to click or do anything (zero-click), and no physical or RF adjacency. The trigger is a single crafted HTTP(S) request whose body embeds the command-substitution payload [5]. Because the request is a normal, well-formed HTTP method against a normal management endpoint, it does not depend on timing, race conditions, or a prepared device state; the same static request works against every affected device.

Step-by-step exploitation chain [5][6][7]:

1. Locate an internet- or LAN-reachable Hikvision device with its web server exposed on 80/443 — mass discovery is automated by the public nuclei template.
2. Send one crafted, unauthenticated request (e.g., PUT /SDK/webLanguage) carrying a $(...) payload in the <language> element.
3. Insufficient validation lets the injected command reach the root-privileged OS shell, bypassing psh.
4. Confirm execution using safe file write/read, reboot-based verification, blind command execution, direct command execution with output, or by spawning an interactive SSH shell — all supported by the public PoC.
5. Escalate to durable control: dump /etc/passwd, create a system account with /bin/sh, launch a dropbear SSH server on an arbitrary port, and disable web authentication.
6. At fleet scale, replay the identical primitive across the large installed base for mass compromise (e.g., botnet enrollment).

Why each escalation step follows from the primitive: once a command runs as root, reading /etc/passwd is an ordinary file read; adding an account is an ordinary file write to the same authentication database; starting dropbear on an arbitrary port converts the one-shot injection into a durable, interactive channel that survives after the HTTP request completes; and disabling web authentication removes the (already-bypassed) front-door control so subsequent access looks legitimate. None of these require a second vulnerability — they are all direct uses of root code execution [5][6].

Proof-of-concept status: public and weaponized. There is a public PoC (Aiminsun/CVE-2021-36260) implementing safe/unsafe checks, blind and standard command execution, and an interactive SSH shell [6], plus a widely used nuclei detection template [7]. The vulnerability is confirmed exploited in the wild — CISA added it to the Known Exploited Vulnerabilities catalog on 2022-01-10 [2].

One deliberate gap: the original discoverer withheld the precise flawed-code internals — the exact vulnerable binary and function — to protect users, so public sources describe the reachable endpoint and payload behavior but not the underlying code path [5]. This means the <language> element is documented as a confirmed-reachable injection surface (the one used by public tooling), not necessarily as the single originally-discovered vector.

4. Discovery & timeline

The vulnerability was discovered and disclosed by the researcher “Watchful IP” (watchfulip.github.io), who reverse-engineered the firmware and ran a coordinated disclosure with Hikvision’s HSRC [5]. Timeline [5][2][3]:

• 2021-06-20 — discovered
• 2021-06-21 — vendor (Hikvision) notified
• 2021-06-23 — HSRC confirmed reproduction
• 2021-07-12 — CVE assigned
• 2021-08-17 — patched firmware provided for testing
• 2021-09-18 — public advisory released (~90 days after discovery)
• 2021-09-28 — CISA alert published [3]
• 2022-01-10 — added to CISA KEV, remediation due 2022-01-24 [2]

The researcher confirmed the vendor patches fixed the issue as recommended [5].

5. Technical reference

• CVE: CVE-2021-36260 [1]
• CWE: CWE-78 (Improper Neutralization of Special Elements used in an OS Command / OS Command Injection) [1]
• CVSS v3.1: base score 9.8 CRITICAL, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H [1]. What the metrics mean mechanically: AV:N — reachable over the network; AC:L — a single crafted request, no special conditions; PR:N — no privileges needed; UI:N — zero-click, no operator action; S:U — the scored impact stays within the vulnerable component’s own security scope (the device); C:H/I:H/A:H — full loss of confidentiality, integrity, and availability of the device. (The real-world significance of a root primitive on a physical-security sensor, which the S:U metric does not capture, is analyzed in §6.)
• Exploited in the wild: yes — CISA KEV, added 2022-01-10, knownRansomwareCampaignUse: Unknown [2].
• Code/commit refs: no vendor commit disclosed; internal vulnerable function deliberately withheld by discoverer [5]. Public tooling refs: Aiminsun/CVE-2021-36260 PoC [6]; ProjectDiscovery nuclei template CVE-2021-36260.yaml [7].
• Fixed firmware examples: IPC_G3 and IPC_H5 at V5.5.800 build 210628 [5]; full matrix in HSRC-202109-01 [4].

6. Consequence & CFSE path analysis

Real-world consequence: an attacker who reaches an affected device over the network gains root control of a camera or NVR without any credentials or operator action. Concretely, they can watch and copy live and recorded video, and — more dangerously — they can suppress, freeze, or fabricate the feed that operators and guards depend on. A surveillance device that has been silently turned against its owner degrades the operator’s perception of physical-world safety, which is the consequence that matters most here. Because the same request works against every unpatched device, that single primitive also scales across an enormous installed base. This is why a root primitive on a physical-security sensor carries outsized real-world meaning that the CVSS S:U (scope unchanged) metric, which scores only the device’s own security scope, does not capture.

Why the CFSE Path Score diverges from CVSS: CVSS caps the story at a single device with S:U (scope unchanged) and a 9.8. CFSE instead scores the consequence the primitive enables, and for a physical-security sensor a root RCE is not just “device compromise” — it is manipulated perception that drives real-world action, plus fleet-scale reusability that CVSS’s per-instance model does not capture. That is why multiple paths uplift from CRITICAL to EMERGENCY.

CFSE consequence verdict:

verdict: EMERGENCY. The entry decomposes CVE-2021-36260 into three co-dominant consequence paths, all landing at EMERGENCY. The PERCEPTION_TO_ACTION path treats the camera as a physical-security sensor: unauthenticated root RCE lets an attacker exfiltrate live/stored video and suppress or fabricate the feed that operators and guards rely on, degrading perception of real-world safety (base band EMERGENCY, no adjustment). The ACCOUNT_AUTHORITY path captures single-device takeover, where root code execution yields the highest authority over the embedded OS, config, credentials, and firmware (but not the vendor firmware-signing root); it starts at CRITICAL and is uplifted to EMERGENCY because the unauthenticated root primitive is remotely reusable fleet-wide and recovery needs coordinated patching/reflash. The FLEET_CONTROL_PLANE path captures scale: a single reusable primitive across an enormous installed base enables mass scanning and Mirai-style botnet enrollment, though it is bounded aggregation of compromised nodes rather than control of Hikvision’s legitimate management/signing infrastructure (CRITICAL uplifted to EMERGENCY). All three share RE:4 (internet-reachable, unauthenticated), EC:4 (single crafted HTTP request, public PoCs), and EV:4 (field-confirmed, in CISA KEV). The overall path_verdict is EMERGENCY, with the dominant consequence being manipulated perception that drives action.

7. Remediation & mitigations

Specific to this bug [4][2][5]:

• Apply Hikvision’s patched firmware per advisory HSRC-202109-01. Confirmed-fixed examples include IPC_G3 and IPC_H5 at V5.5.800 build 210628; consult HSRC-202109-01 for the per-model fixed build. This is the CISA KEV required action (“Apply updates per vendor instructions,” due 2022-01-24) [2][4].
• Remove the web interface from untrusted/internet exposure. Because the primitive is unauthenticated and network-reachable, segment and firewall the device management ports (80/443) so they are not reachable from untrusted networks; this eliminates the trigger precondition even before patching completes [5].
• Audit for prior compromise on any device that was internet-exposed while unpatched. The known post-exploitation artifacts are concrete: inspect /etc/passwd for unexpected accounts (especially ones with /bin/sh), look for an unexpected dropbear SSH server listening on an arbitrary port, and check whether web authentication has been disabled [5]. Rotate device credentials after patching.
• Because firmware can be modified by a root attacker, treat a confirmed-compromised device as needing a trusted reflash rather than a config reset alone.

8. Sources

[1] CVE-2021-36260 Detail — NVD (NIST) — https://nvd.nist.gov/vuln/detail/CVE-2021-36260 — authoritative CVE record: CWE-78, CVSS 9.8 vector, affected firmware range. Credibility: primary-advisory. [2] CISA KEV Catalog entry — CVE-2021-36260 — CISA — https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-36260 — confirms in-the-wild exploitation, KEV add date and remediation due date. Credibility: primary-advisory. [3] RCE Vulnerability in Hikvision Cameras (CVE-2021-36260) — CISA — https://www.cisa.gov/news-events/alerts/2021/09/28/rce-vulnerability-hikvision-cameras-cve-2021-36260 — government notification pointing to vendor advisory/firmware. Credibility: primary-advisory. [4] Security Notification — Command Injection Vulnerability in Some Hikvision Products (HSRC-202109-01) — Hikvision — https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification-command-injection-vulnerability-in-some-hikvision-products/ — vendor advisory with affected/fixed model matrix and patch remediation. Credibility: primary-advisory. [5] Unauthenticated Remote Code Execution (RCE) vulnerability in Hikvision IP camera/NVR firmware (CVE-2021-36260) — Watchful IP — https://watchfulip.github.io/2021/09/18/Hikvision-IP-Camera-Unauthenticated-RCE.html — original discoverer writeup: zero-click/unauthenticated nature, root vs psh, post-exploitation, timeline, affected scope. Credibility: researcher-primary. [6] Aiminsun/CVE-2021-36260 (public PoC) — GitHub (Aiminsun) — https://github.com/Aiminsun/CVE-2021-36260 — weaponized PoC: safe/unsafe checks, blind/standard command execution, interactive SSH shell. Credibility: community-poc. [7] nuclei-templates CVE-2021-36260.yaml (detection template) — GitHub (ProjectDiscovery) — https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-36260.yaml — automated detection showing the PUT /SDK/webLanguage endpoint, <language> $(...) payload, and GET /x verification. Credibility: community-poc. [8] RCE vulnerability found in Hikvision cameras, CISA notifies — Industrial Cyber — https://industrialcyber.co/article/rce-vulnerability-found-in-hikvision-cameras-cisa-notifies/ — OT/ICS press summary of disclosure, CISA notification, scale/impact. Credibility: reputable-press.