漏洞描述
Certain Hikvision products contain a command injection vulnerability in the web server due to the insufficient input validation. An attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
watchfulip.github.iohttps://watchfulip.github.io/2021/09/18/Hikvision-IP-Camera-Unauthenticated-RCE.html↗www.hikvision.comhttps://www.hikvision.com/en/support/cybersecurity/security-advisory/security-notification-command-injection-vulnerability-in-some-hikvision-products/↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2021-36260↗github.comhttps://github.com/Aiminsun/CVE-2021-36260↗