CVE-2021-36260 PoC — Hikvision Web Server 操作系统命令注入漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/vulnerabilities/iot/hikvision/hikvision-cam-info-exposure.yaml

Associated Vulnerability

Title:Hikvision Web Server 操作系统命令注入漏洞 (CVE-2021-36260)
Description:A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.

Description

Unauthenticated exposure of sensitive endpoints was detected on vulnerable Hikvision IP cameras. This included live snapshot feeds, encrypted configuration files, and full user credential XML through CVE-2021-36260 exploit chaining and bypass logic.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →