CVE-2021-36260Active Exploitation(hikvision / ds-2cd2021g1-i\(w\))

#RCE attempt targeting Hikvision IP Cameras to deliver #Mirai #CVE-2021-36260 2026-03-29 15:34:47 UTC Source IP: 151.243.11.23 🇦🇪 PUT /SDK/webLanguage IOCs: 151.243.11[.]23 🇦🇪 https://t.co/lxYMVH1O06

We scanned 2% of the Internet to search for CVE-2021-36260. "Web Version: 4.0.1" Hikvision IP Camera: Server: App-webs/ http://45.67.33.116 http://178.67.142.209 http://221.125.65.166 http://80.243.236.30 http://197.91.240.245 http://80.115.112.39 http://82.79.96.238 http://217.23.77.226 http://202.22.145.160 http://125.19.41.134 http://213.5.53.140 http://196.251.236.30 http://73.3.122.172 http://83.239.8.18 http://82.79.96.200 http://212.5.157.151 http://202.62.145.40 http://103.5.104.6 http://77.242.27.182 http://70.67.25.240 http://24.54.195.107 http://213.232.237.72 http://213.232.237.157 http://99.233.25.12 http://82.79.96.248 http://70.69.25.251 http://82.79.96.245 http://83.166.36.114 http://184.167.64.213 http://110.172.22.53 http://70.67.25.168 http://81.162.20.9 http://112.168.154.77 http://118.209.192.158 http://189.147.225.11 http://213.109.239.85 http://95.165.33.198 http://2.108.147.240 http://82.79.96.199 http://213.232.237.168 http://31.134.133.190 http://158.255.249.154 http://172.125.186.45 There are all [+] Remote is not vulnerable (Code: 404)

@TheDFIRReport This IPv4 on port 443 hosted ligolo-ng from 2025-02-28 to 2025-03-29, 54[.]232.65.189 also the same ligolo-ng tied to an IPSec VPN, 91[.]84.100.59 also but scans for CVE-2021-36260 hikvision-cam-info-exposure, 185[.]205.210.220 w/ c1d8cfc065517dfa1a59d5ca614f278b

@Trumpyla @SpencerGuard @Forbes Here are GitHub links with POCs for those CVEs: CVE-2021-36260 https://github.com/Aiminsun/CVE-2021-36260 CVE-2025-34067 POC https://github.com/PeiQi0/PeiQi-WIKI-Book/blob/main/docs/wiki/iot/HIKVISION/HIKVISION%20%E7%BB%BC%E5%90%88%E5%AE%89%E9%98%B2%E7%AE%A1%E7%90%86%E5%B9%B3%E5%8F%B0%20applyCT%20Fastjson%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md CVE-2023-6895 https://github.com/FuBoLuSec/CVE-2023-6895 CVE-2021-33044 https://github.com/haingn/LoHongCam-CVE-2021-33044 Use responsibly 😂👁️

Here’s a list of key CVEs enabling RCE (remote code execution) in Chinese-made Hikvision and Dahua IP cameras/NVRs widely deployed in Iran’s urban surveillance networks: - **CVE-2021-36260** (Hikvision): Unauthenticated command injection RCE in web server (CVSS 9.8). Actively exploited. - **CVE-2025-34067** (Hikvision): Unauthenticated RCE in Integrated Security Management Platform. - **CVE-2023-6895** (Hikvision): OS command injection RCE in Intercom Broadcasting System. - **CVE-2021-33044** (Dahua): Authentication bypass often chained to RCE. Outdated firmware on these systems turns them into prime targets—whether for regime tracking or reverse ops. Patch ASAP or they’re fair game. 👁️

@T3chFalcon Default credentials get the headlines, but unauthenticated RCE is worse. Hikvision CVE-2021-36260 needed no password at all. Firmware hygiene beats password hygiene on these devices.

@vxunderground But you see I was reported by Threat Actors even for posting a historical proof-of-concept/API analysis/and scanning activities related to CVE-2021-36260.

Google: Hikvision devices face significant security risks, including critical remote hijacking vulnerabilities (CVE-2021-36260) that allow unauthorized access to cameras and network, scoring a maximum 9.8 on the CVSS scale. Due to these risks and potential data transmission to Chinese servers, Hikvision equipment is banned from U.S. government contracts under NDAA compliance rules.

@tarunmallappa CVE-2021-36260: unauthenticated RCE on Hikvision actively exploited flagged by CISA these weren’t just Chinese-made cameras they were actively compromised

@utsavtechie CVE-2021-36260 gave unauthenticated RCE on Hikvision cameras. Actively exploited. Default creds on Dahua devices are still a joke in every pentest report.

You're spot on. Hikvision/Dahua gear dominates China's 700M+ cams—firmware often outdated/vulnerable to zero-click RCE (CVE-2021-36260), buffer overflows (recent 2025-26 CVEs), weak auth. Patching is cumbersome/rare at scale; many devices unpatched years later. China's IoT defensive habits lag per audits—slow fixes, known exploits by criminals/states. Advanced actors could mirror Iran ops.

Yes, photos from DRDO's Tapas UAV flight control room clearly show a Hikvision (Chinese-made) CCTV camera installed there. This has raised valid security concerns due to Hikvision's documented vulnerabilities like remote code execution flaws (e.g., CVE-2021-36260) and global bans over potential backdoors. Standalone CCTVs can indeed be hacked if networked/internet-exposed. EVMs, however, are fully air-gapped, offline machines with no wireless/network ports, source code secrecy, physical seals, and VVPAT verification. Per ECI and court rulings, remote hacking isn't possible—the setups aren't comparable.