# N/A
## 概述
存在一个命令注入漏洞，影响某些海康威视产品的Web服务器。由于输入验证不足，攻击者可以通过发送包含恶意命令的消息来利用该漏洞发起命令注入攻击。
## 影响版本
未提供具体影响的版本信息。
## 细节
攻击者可以发送包含恶意命令的消息，利用Web服务器输入验证不足的漏洞，以此实现命令注入攻击。
## 影响
成功利用该漏洞可能导致攻击者执行任意命令，从而控制受影响的设备或系统。
是否为 Web 类漏洞： 是
判断理由：
| # | POC 描述 | 源链接 | 神龙链接 |
|---|---|---|---|
| 1 | CVE-2021-36260 | https://github.com/rabbitsafe/CVE-2021-36260 | POC详情 |
| 2 | command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands. | https://github.com/Aiminsun/CVE-2021-36260 | POC详情 |
| 3 | the metasploit script(POC) about CVE-2021-36260 | https://github.com/TaroballzChen/CVE-2021-36260-metasploit | POC详情 |
| 4 | CVE-2021-36260 | https://github.com/tuntin9x/CheckHKRCE | POC详情 |
| 5 | 海康威视RCE漏洞 批量检测和利用工具 | https://github.com/Cuerz/CVE-2021-36260 | POC详情 |
| 6 | None | https://github.com/TakenoSite/Simple-CVE-2021-36260 | POC详情 |
| 7 | Brute Hikvision CAMS with CVE-2021-36260 Exploit | https://github.com/r3t4k3r/hikvision_brute | POC详情 |
| 8 | None | https://github.com/haingn/HIK-CVE-2021-36260-Exploit | POC详情 |
| 9 | A simple workflow that runs all Hikvision related nuclei templates on a given target. | https://github.com/projectdiscovery/nuclei-templates/blob/main/workflows/hikvision-workflow.yaml | POC详情 |
| 10 | Certain Hikvision products contain a command injection vulnerability in the web server due to the insufficient input validation. An attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-36260.yaml | POC详情 |
| 11 | None | https://github.com/Threekiii/Awesome-POC/blob/master/%E7%BD%91%E7%BB%9C%E8%AE%BE%E5%A4%87%E6%BC%8F%E6%B4%9E/HIKVISION%20DSIDSIPC%20%E7%AD%89%E8%AE%BE%E5%A4%87%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%20CVE-2021-36260.md | POC详情 |
| 12 | None | https://github.com/chaitin/xray-plugins/blob/main/poc/manual/hikvision-unauthenticated-rce-cve-2021-36260.yml | POC详情 |
| 13 | Brute Hikvision CAMS with CVE-2021-36260 Exploit | https://github.com/NanoTrash/hikvision_brute | POC详情 |
| 14 | HikvisionExploiter is a Python-based utility designed to automate exploitation and directory accessibility checks on Hikvision network cameras exploiting the Web interface Version 3.1.3.150324 + CVE-2021-36260 Detection | https://github.com/tamim1089/HikvisionExploiter | POC详情 |
| 15 | Unauthenticated exposure of sensitive endpoints was detected on vulnerable Hikvision IP cameras. This included live snapshot feeds, encrypted configuration files, and full user credential XML through CVE-2021-36260 exploit chaining and bypass logic. | https://github.com/projectdiscovery/nuclei-templates/blob/main/vulnerabilities/iot/hikvision/hikvision-cam-info-exposure.yaml | POC详情 |
| 16 | Unauthenticated exposure of sensitive endpoints was detected on vulnerable Hikvision IP cameras. This included live snapshot feeds, encrypted configuration files, and full user credential XML through CVE-2021-36260 exploit chaining and bypass logic. | https://github.com/projectdiscovery/nuclei-templates/blob/main/http/iot/hikvision-cam-info-exposure.yaml | POC详情 |
| 17 | None | https://github.com/shubtheone/CVE-2021-36260-hikvision | POC详情 |
暂无评论