Hikvision Camera Vulnerability Targeted in Remote Code Execution Exploitation Attempts

What happened?

Scanning and remote code execution attempts targeting video surveillance devices in Ukraine rose between September 21 and October 1, 2026. Most activity focused on CVE-2021-36260, a critical command injection flaw in unpatched Hikvision products. The surge occurred alongside Russian missile and drone strikes, but researchers have not established a connection between the cyber activity and those attacks. The findings highlight renewed interest in an older vulnerability that can let attackers control exposed cameras and recording equipment without signing in.

Key details

• Remote scanning and code execution attempts against Ukrainian video surveillance devices increased from Sep 21 to Oct 1, 2026.
• Four IPs performed almost all attempts; three were PureVPN exit nodes and one originated from a Ukrainian network.
• All requests used the same command‑test without any payload, and no further activity was seen after Oct 7.
• CVE‑2021‑36260 affects the web server of certain Hikvision models, allowing crafted requests to execute OS commands.
• Attackers employed the public Nuclei template “Hikvision IP camera/NVR – Remote Command Execution,” indicating automated testing.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.