Loading story…
MBSD-SOC reported a sharp rise in exploitation attempts against Hikvision network cameras using CVE-2021-36260, an unauthenticated OS command injection flaw in the products’ web server component. The vulnerability stems from improper input validation and can allow remote code execution as the root user by sending crafted requests to the device.
The observed attacks used a PUT request to /SDK/webLanguage and injected commands through XML content, with MBSD-SOC noting detections increased significantly after May 26, 2023. Telemetry showed most attack traffic originated from the United States, followed by Germany, Japan, France, and Romania, underscoring continued broad internet scanning and exploitation of exposed Hikvision devices.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
MBSD-SOC published its May 2023 detection trends and highlighted increased attacks targeting CVE-2021-36260 in Hikvision network cameras. Its telemetry showed most apparent attack sources in May were from the United States, followed by Germany, Japan, France, and Romania.
MBSD-SOC reported that detections of attacks targeting CVE-2021-36260 increased after Friday, May 26, 2023, following intermittent observations earlier in the year. The observed exploit traffic used HTTP PUT requests to /SDK/webLanguage with command injection embedded in XML.
The CVE record for CVE-2021-36260 was later updated. The source notes this update occurred after the original publication of the Hikvision vulnerability entry.
The CVE record for CVE-2021-36260 was published, documenting a command injection vulnerability in the web server of some Hikvision products caused by insufficient input validation. The flaw could allow attackers to send malicious commands and achieve command injection.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers exploited **CVE-2021-36260**, a critical unauthenticated remote code execution flaw in Hikvision IP cameras and NVRs, to compromise exposed devices and install the Mirai-based **Moobot** botnet. The vulnerability stems from improper input validation in the web server’s `language` parameter, allowing command injection without authentication on vulnerable firmware. Public reporting and technical writeups showed the flaw could be used to execute arbitrary commands remotely against internet-facing surveillance systems. Fortinet reported that observed attacks used the flaw to drop a small ARM downloader, retrieve a Moobot payload from `199.195.250[.]233`, and run it as **`macHelper`**. The malware then communicated with the command-and-control domain `life.zerobytes[.]cc`, sent heartbeat traffic, and enabled multiple distributed denial-of-service capabilities, including **SYN**, **UDP**, **ACK**, and **ACK+PUSH** flood attacks. Researchers also linked the activity to a Telegram channel advertising DDoS services, while Hikvision issued patches and defenders published detection and blocking coverage.
Aug 15, 2026
Akamai’s Security Intelligence and Response Team (SIRT) disclosed a **critical remote command injection** vulnerability in *Vivotek* legacy IP camera firmware tracked as **CVE-2026-22755** (reported **CVSS 9.3**). The flaw enables **unauthenticated attackers to execute arbitrary commands as `root`** by abusing the camera’s file upload handling in the `upload_map.cgi` CGI endpoint, where a user-controlled filename is incorporated into a formatted string and then passed to a shell via `system()` without proper sanitization, allowing shell metacharacter injection (e.g., `;`). Technical reporting indicates exploitation hinges on crafting an upload that satisfies several implementation constraints (e.g., upload size limits and firmware validation behaviors) and invoking the upload path in a way that preserves required environment variables; researchers demonstrated command execution by embedding commands in the filename and observing `uid=0` output. The issue reportedly impacts **dozens of models (36 cited)** across multiple Vivotek product lines and is amplified by findings that some affected legacy devices may ship or operate **without passwords set by default**, increasing the likelihood of opportunistic compromise and downstream abuse (e.g., botnet recruitment and DDoS activity) in environments still running legacy surveillance infrastructure.
Jun 29, 2026
Cisco Talos disclosed newly patched vulnerabilities in **GeoVision** products as part of a broader third-party advisory covering WolfSSL, GeoVision, and VTK-DICOM. The GeoVision portion spans **14 advisories and 37 CVEs**, including weaknesses such as OS command injection, privilege escalation, reflected XSS, guessable session cookies, insufficient encryption, lack of authentication, and buffer-handling flaws. Talos said the affected vendors have released patches and noted that **Snort coverage** is available to help detect exploitation attempts. Reporting on the GeoVision issues highlighted critical flaws in **LPC2011/LPC2211** license-plate recognition cameras and **GV-VMS** software. In particular, `CVE-2026-42364` is an OS command injection in `DdnsSetting.cgi` on camera firmware `1.10`, and `CVE-2026-42368` is a privilege-escalation bug that can be chained for full **root compromise** through the web interface; a separate flaw, `CVE-2026-42369`, enables unauthenticated remote code execution in **GV-VMS V20**. Because the cameras are commonly deployed in parking, checkpoint, hospital, airport, and other physical-security environments, successful exploitation could provide a foothold for lateral movement, surveillance disruption, and access into adjacent building-management or access-control networks.
Jul 10, 2026