Spike in exploitation of Hikvision CVE-2021-36260 against Ukrainian DVRs amid Russian strikes
GreyNoise observed an increase in scanning and exploitation attempts against Digital Video Recorders (DVRs) in Ukraine between 21 September and 1 October 2026, coinciding with an escalation in Russian strikes. Most of the activity targeted CVE-2021-36260, an unauthenticated command injection flaw in unpatched Hikvision products. GreyNoise notes that compromised DVRs could give an actor physical surveillance of an area, supporting battlespace awareness before, during and after kinetic strikes. The activity came from three PureVPN exit nodes and one Ukrainian domestic IP. GreyNoise attributes the PureVPN activity to a single entity and assesses, with low confidence, that the domestic IP is possibly related. No actor or group is named.
Technical Details
- The actors used the Nuclei template "Hikvision IP camera/NVR - Remote Command Execution" to exploit CVE-2021-36260.
- The four IPs (three PureVPN exit nodes, one Ukrainian IP) targeted only GreyNoise sensors located in Ukraine and none elsewhere.
- GreyNoise saw almost no comparable activity against Ukraine in prior months, and none from these four IPs.
- A global spike in scanning and exploitation of CVE-2021-36260 was also observed.
- PureVPN is a commercial VPN, so activity from its exit nodes may be unrelated because of legitimate shared use.
Remediation
The article gives no explicit remediation. The vulnerability affects unpatched Hikvision products, so patching affected devices is the implied mitigation.
Exploit público
Há código de exploração publicado no Exploit-DB para CVE-2021-36260. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.
-
Hikvision Web Server Build 210702 - Command Injection
This script exploits CVE-2021-36260, an unauthenticated command injection in the web server of Hikvision IP cameras, reached through a crafted XML request to a web-language configuration endpoint. The attacker only needs network access to the camera's web port and a firmware build that has not been patched; no login or user interaction is required. It runs commands as root, returns their output, can reboot the device and can open a persistent SSH backdoor with a passwordless account. It is a working, mature exploit with a safe check mode, so exposed cameras should be patched and kept off the internet.
Linha do tempo
-
Spike in exploitation of Hikvision CVE-2021-36260 against Ukrainian DVRs amid Russian strikes
ler a análise desta fonte ocultar
GreyNoise observed an increase in scanning and exploitation attempts against Digital Video Recorders (DVRs) in Ukraine between 21 September and 1 October 2026, coinciding with an escalation in Russian strikes. Most of the activity targeted CVE-2021-36260, an unauthenticated command injection flaw in unpatched Hikvision products. GreyNoise notes that compromised DVRs could give an actor physical surveillance of an area, supporting battlespace awareness before, during and after kinetic strikes. The activity came from three PureVPN exit nodes and one Ukrainian domestic IP. GreyNoise attributes the PureVPN activity to a single entity and assesses, with low confidence, that the domestic IP is possibly related. No actor or group is named.
Technical Details
- The actors used the Nuclei template "Hikvision IP camera/NVR - Remote Command Execution" to exploit CVE-2021-36260.
- The four IPs (three PureVPN exit nodes, one Ukrainian IP) targeted only GreyNoise sensors located in Ukraine and none elsewhere.
- GreyNoise saw almost no comparable activity against Ukraine in prior months, and none from these four IPs.
- A global spike in scanning and exploitation of CVE-2021-36260 was also observed.
- PureVPN is a commercial VPN, so activity from its exit nodes may be unrelated because of legitimate shared use.
Remediation
The article gives no explicit remediation. The vulnerability affects unpatched Hikvision products, so patching affected devices is the implied mitigation.