cve/2021/CVE-2021-36260.md

CVE-2021-36260

Description

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.

POC

Reference

• http://packetstormsecurity.com/files/164603/Hikvision-Web-Server-Build-210702-Command-Injection.html
• http://packetstormsecurity.com/files/166167/Hikvision-IP-Camera-Unauthenticated-Command-Injection.html

Github

• https://github.com/0day404/vulnerability-poc
• https://github.com/0xMarcio/cve
• https://github.com/12442RF/POC
• https://github.com/1f3lse/taiE
• https://github.com/20142995/Goby
• https://github.com/20142995/nuclei-templates
• https://github.com/20142995/sectool
• https://github.com/34zY/APT-Backpack
• https://github.com/4n4nk3/HikPwn
• https://github.com/APPHIK/cam
• https://github.com/APPHIK/camz
• https://github.com/APPHIK/ip
• https://github.com/APPHIK/ipp
• https://github.com/ARPSyndicate/cve-scores
• https://github.com/ARPSyndicate/cvemon
• https://github.com/ARPSyndicate/kenzer-templates
• https://github.com/AbdulrahmanTamim/HikvisionExploiter
• https://github.com/Aiminsun/CVE-2021-36260
• https://github.com/Andromeda254/cve
• https://github.com/ArrestX/--POC
• https://github.com/Awrrays/FrameVul
• https://github.com/CVEDB/awesome-cve-repo
• https://github.com/CVEDB/top
• https://github.com/Cuerz/CVE-2021-36260
• https://github.com/DMW11525708/wiki
• https://github.com/Fans0n-Fan/Awesome-IoT-exp
• https://github.com/GhostInShellX404/HikvisionExploitGUI
• https://github.com/GhostTroops/TOP
• https://github.com/Haoke98/NetEye
• https://github.com/HexBuddy/HikvisionExploiter
• https://github.com/HimmelAward/Goby_POC
• https://github.com/InfoSec-DB/Hikvision-AfterDark
• https://github.com/KayCHENvip/vulnerability-poc
• https://github.com/Lern0n/Lernon-POC
• https://github.com/MInggongK/Penetration-mining-src
• https://github.com/Miraitowa70/POC-Notes
• https://github.com/Miuguel/psychic-chainsaw
• https://github.com/Mr-xn/Penetration_Testing_POC
• https://github.com/NaInSec/CVE-PoC-in-GitHub
• https://github.com/NanoTrash/hikvision_brute
• https://github.com/Nxychx/TVT-NVR
• https://github.com/NyxAzrael/Goby_POC
• https://github.com/Ostorlab/KEV
• https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors
• https://github.com/R3KT00YT/ScanCam
• https://github.com/ROYSCANNER/ROY
• https://github.com/ROYSCANNER/ROYIP
• https://github.com/ROYSCANNER/cctv
• https://github.com/ROYSCANNER/live
• https://github.com/SYRTI/POC_to_review
• https://github.com/ShivamB25/shodan-cam
• https://github.com/Sidhukali/ingram
• https://github.com/SlickxMercy/ArgusEye
• https://github.com/SlickxMercy/WebCamHack
• https://github.com/Stealzoz/steal
• https://github.com/TakenoSite/RemoteUploader
• https://github.com/TakenoSite/Simple-CVE-2021-36260
• https://github.com/TaroballzChen/CVE-2021-36260-metasploit
• https://github.com/Threekiii/Awesome-POC
• https://github.com/WhooAmii/POC_to_review
• https://github.com/XiaomingX/awesome-poc-for-red-team
• https://github.com/Z0fhack/Goby_POC
• https://github.com/adysec/POC
• https://github.com/aengussong/hikvision_probe
• https://github.com/anquanscan/sec-tools
• https://github.com/bigblackhat/oFx
• https://github.com/bnhjuy77/tomde
• https://github.com/botmagician/HikVisionAliceToolkit
• https://github.com/bright-angel/sec-repos
• https://github.com/cc8700619/poc
• https://github.com/d4n-sec/d4n-sec.github.io
• https://github.com/eeeeeeeeee-code/POC
• https://github.com/ghosinshell/Nuclei-POC
• https://github.com/haingn/HIK-CVE-2021-36260-Exploit
• https://github.com/hheeyywweellccoommee/hikvision_brute-jnrxx
• https://github.com/jorhelp/Ingram
• https://github.com/kr4k0n/Ingram
• https://github.com/laoa1573/wy876
• https://github.com/lions2012/Penetration_Testing_POC
• https://github.com/lisksemen/HikExp
• https://github.com/mcw0/PoC
• https://github.com/naycha/NVR-CONFIG
• https://github.com/naycha/TVT-NVR
• https://github.com/naycha/TVT-NVR-config
• https://github.com/naycha/TVT-config
• https://github.com/nomi-sec/PoC-in-GitHub
• https://github.com/nyctop/ing2
• https://github.com/oLy0/Vulnerability
• https://github.com/onewinner/VulToolsKit
• https://github.com/postfix/cctvscan
• https://github.com/r3t4k3r/hikvision_brute
• https://github.com/rabbitsafe/CVE-2021-36260
• https://github.com/readloud/PoC
• https://github.com/s0duku/PocSelenium
• https://github.com/soosmile/POC
• https://github.com/tamim1089/HikvisionExploiter
• https://github.com/tanjiti/sec_profile
• https://github.com/trhacknon/Pocingit
• https://github.com/tuntin9x/CheckHKRCE
• https://github.com/winterwolf32/CVE-S---Penetration_Testing_POC-
• https://github.com/xuetusummer/Penetration_Testing_POC
• https://github.com/zecool/cve
• https://github.com/zhanwang110/Ingram