Cybersecurity firm Cyfirma has identified more than 80,000 Hikvision cameras that haven’t been patched against a critical code execution vulnerability exploited in the wild.
Tracked as CVE-2021-36260, the vulnerability leads to root access and allows an attacker to take full control of a device and potentially compromise the entire network. More than 70 Hikvision device models are impacted.
The security bug has a CVSS rating of 9.8, given that exploitation only requires access to the HTTP(S) server port (typically 80/443), without authentication.
Exploits targeting the vulnerability were published in October 2021 and February 2022. In December 2021, the Mirai-based ‘Moobot’ botnet was observed targeting the vulnerability in attacks.
In January 2022, CISA added the security flaw to its ‘must-patch’ list, which catalogs vulnerabilities for which the agency has evidence of in-the-wild exploitation.
Fixes for CVE-2021-36260 have been available since September 2021, but tens of thousands of Hikvision cameras and NVRs remain unpatched.
According to Cyfirma, there are over 80,000 unpatched Hikvision devices – out of a total of 285,000 – that are accessible from the internet, thus exposed to potential takeover.
More than 2,000 organizations in over 100 countries are potentially exposed to attacks, especially since many of the vulnerable devices also have multiple ports opened, the cybersecurity firm says in a report (PDF).
The largest number of vulnerable devices are located in China (roughly 12,700), US (~10,000), Vietnam (~7,300), UK (~4,800), and Ukraine (~3,000).
Cyfirma also notes that it has reason to believe that Chinese and Russian advanced persistent threat (APT) actors are likely to exploit vulnerabilities in these devices.
“Specifically in the Russian forums, we have observed leaked credentials of Hikvision camera products available for sale. These can be leveraged by hackers to gain access to the devices and exploit further the path of attack to target an organization’s environment,” Cyfirma says.
Related: Unpatched Micodus GPS Tracker Vulnerabilities Allow Hackers to Remotely Disable Cars
Related: Many IoT Devices Exposed to Attacks Due to Unpatched Flaw in uClibc Library
Related: CISA Warns of Hikvision Camera Flaw as U.S. Aims to Rid Chinese Gear From Networks
More from Ionut Arghire
- Memcyco Raises $10 Million in Seed Funding to Prevent Website Impersonation
- Apria Healthcare Notifying 2 Million People of Years-Old Data Breaches
- European Cybersecurity Firm Sekoia.io Raises $37.5 Million
- GitLab Security Update Patches Critical Vulnerability
- Android App With 50,000 Downloads in Google Play Turned Into Spyware via Update
- US Sanctions North Korean University for Training Hackers
- New ‘GoldenJackal’ APT Targets Middle East, South Asia Governments
- Iranian Hackers Using New Windows Kernel Driver in Attacks
Latest News
- Memcyco Raises $10 Million in Seed Funding to Prevent Website Impersonation
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
- Security Pros: Before You Do Anything, Understand Your Threat Landscape
- Major Massachusetts Health Insurer Hit by Ransomware Attack, Member Data May Be Compromised
- Apria Healthcare Notifying 2 Million People of Years-Old Data Breaches
- European Cybersecurity Firm Sekoia.io Raises $37.5 Million
- Today’s Cyber Defense Challenges: Complexity and a False Sense of Security
- Drop in Insider Breaches Drives Decline in Intrusions at OT Organizations

