COMMAND INJECTION VULNERABILITY IN SOME HIKVISION PRODUCTS

September 18, 2021

Security Notification - Important Product Firmware Update

SN No.: HSRC-202109-01

Edit: Hikvision Security Response Center (HSRC)

Initial release date: 2021-09-19

Summary:

A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.

CVE ID:

CVE-2021-36260

Scoring:

CVSS v3 is adopted in this vulnerability scoring（http://www.first.org/cvss/specification-document）

Base score: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Temporal score: 8.8 (E:P/RL:O/RC:C)

Affected versions and resolved version:

Information of affected versions and resolved versions：

Product Category	Product name	Affected version(s)	Fixed Version(s)	Fixed Firmware Download Link
IP Kit	EKI-K41T44(C) EKI-K82T46(C) EKI-K164T412(C) EKI-K41D44(B) EKI-K82D46(B) EKI-K164D412(B) EKI-K82B86 (B)	Versions which Build time from 210224 to 210625	V4.30.216 build210629	https://us.hikvision.com/sites/default/files/firmware/dz_k9b2_ml_std_v4.30.216_210629.zip
Value Express IP	ECI-B12F2, ECI-B12F4 ECI-B12F6, ECI-D12F2 ECI-D12F4, ECI-D12F6 ECI-T22F2, ECI-T22F4 ECI-T22F6, ECI-B62Z2 ECI-D62Z2	Versions which Build time before 210720	V5.5.2 build210720	https://us.hikvision.com/sites/default/files/firmware/pj14pc20210715166_ipchl_e3_en_std_5.5.2_210720.zip
	ECI-T22F2 (B), ECI-T22F4 (B) ECI-D12F2 (B), ECI-D12F4 (B) ECI-B12F2 (B), ECI-B12F4 (B)	Versions which Build time from 210410 to 210721	V5.5.120 build210721	https://us.hikvision.com/sites/default/files/firmware/pj14pc20210402045_...
	ECI-T24F2 (C), ECI-T24F4 (C) ECI-D14F2 (B), ECI-D14F4 (B) ECI-B14F2 (B), ECI-B14F4 (B)	Versions which Build time from 210322 to 210630	V5.5.120 build210630	https://us.hikvision.com/sites/default/files/firmware/pj14pc20210629066_ipce_r_e8_en_std_5.5.120_210630.zip
Value IP	DS-2CD2D21G0/M-D/NF DS-2CD2D21G0-D/NF	Versions which Build time before 210628	V5.5.800 build210628	https://us.hikvision.com/sites/default/files/firmware/ipc_e3_en_std_5.5.800_210628.zip
	DS-2CD2086G2-I, DS-2CD2346G2-I, DS-2CD2386G2-I, DS-2CD2T87G2-L, DS-2CD2087G2-L, DS-2CD2T86G2-4I, DS-2CD2147G2-SU, DS-2CD2686G2T-IZS, DS-2CD2786G2T-IZS, DS-2CD2346G2-ISU/SL, DS-2CD2T46G2-ISU/SL	Versions which Build time before 210625	V5.5.800 210628	https://us.hikvision.com/sites/default/files/firmware/ipc_g3_en_std_5.5.800_210628.zip
	DS-2CD2T47G2-L (C), DS-2CD2087G2-L (C), DS-2CD2047G2-LU (C), DS-2CD2147G2-SU (C), DS-2CD2347G2-LU (C), DS-2CD2647G2-LZS (C), DS-2CD2747G2-LZS (C)	Versions which Build time before 210625	V 5.5.800 210727	https://us.hikvision.com/sites/default/files/firmware/ipc_g5_en_std_5.5.801_210727.zip
	DS-2CD2510F DS-2CD2520F DS-2CD2120F-I	Versions which Build time before 210813	V5.4.800_210813	https://us.hikvision.com/sites/default/files/firmware/ipc_r2_en_std_5.4.800_210813.zip
Performance IP	PCI-B12F2S, PCI-B12F4S, PCI-B12F6S, PCI-B15F2S, PCI-B15F4S, PCI-B15F6S, PCI-B18F2S, PCI-B18F4S, PCI-B18F6S, PCI-D12F2S, PCI-D12F4S, PCI-D12F6S, PCI-D15F2S, PCI-D15F4S, PCI-D15F6S, PCI-T12F2S, PCI-T12F4S, PCI-T12F6S, PCI-T15F2S, PCI-T15F4S, PCI-T15F6S, PCI-T18F2S, PCI-T18F4S, PCI-T18F6S, PCI-LB12F2S, PCI-LB12F4S, PCI-LB12F6S, PCI-LB12F12S, PCI-LB15F2S, PCI-LB15F4S, PCI-LB15F6S, PCI-LB15F12S, PCI-LB18F2S, PCI-LB18F4S, PCI-LB18F6S, PCI-LB18F12S, PCI-B12F2SL, PCI-B12F4SL, PCI-B12F6SL, PCI-B15F2SL, PCI-B15F4SL, PCI-B15F6SL, PCI-T12F2SL, PCI-T12F4SL, PCI-T12F6SL, PCI-T15F2SL, PCI-T15F4SL, PCI-T15F6SL, PCI-LB12F2SL, PCI-LB12F4SL, PCI-LB12F6SL, PCI-LB15F2SL, PCI-LB15F4SL, PCI-LB15F6SL, PCI-B12Z2S, PCI-B15Z2S, PCI-B18Z2S, PCI-D12Z2S, PCI-D15Z2S, PCI-D18Z2S	Versions which Build time before 210703	V5.5.150 build210703	https://us.hikvision.com/sites/default/files/firmware/pj14pc202106291608_g3_en_std_5.5.150_210703.zip
Performance IP	PCI-D18F4S	Versions which Build time before 210805	V5.5.115 build210805	https://us.hikvision.com/sites/default/files/firmware/pj14pc20210803215_ipce_g_g5_en_std_5.5.115_210805.zip
PanoVu	DS-2CD6924G0-HIS DS-2CD6984G0-HIS	Versions which Build time before 210625	V5.5.800 build210628	https://us.hikvision.com/sites/default/files/firmware/ipcp_h5_en_std_5.5.800_210628.zip
Value PTZ (DE series)	DS-2DE2204IW-DE3	Versions which Build time before 210625	V5.4.800 build210812	https://us.hikvision.com/sites/default/files/firmware/ipd_r0_en_std_5.4.800_210812.zip
	DS-2DE2A404IW-DE3		V5.6.800 build210628	https://us.hikvision.com/sites/default/files/firmware/ipde_e7_en_std_5.6.800_210628.zip
	DS-2DE3A400BW-DE		V5.5.802 build210629	https://us.hikvision.com/sites/default/files/firmware/ipde_g3_en_std_5.5.802_210629.zip
	DS-2DE4225W-DE		V5.6.800 build210628	https://us.hikvision.com/sites/default/files/firmware/ipde_e7_en_std_5.6.800_210628.zip
	DS-2DE4225W-DE3		V5.4.800 build210812	https://us.hikvision.com/sites/default/files/firmware/ipd_r0_en_std_5.4.800_210812.zip
	DS-2DE4A225IW-DE		V5.6.800 build210628	https://us.hikvision.com/sites/default/files/firmware/ipde_e7_en_std_5.6.800_210628.zip
	DS-2DE4A425IW-DE
	DS-2DE4425IW-DE
	DS-2DE5225IW-AE
Smart Pro PTZ (DF series)	DS-2DF5232X-AEL DS-2DF5232X-AE3 DS-2DF6A436X-AEL DS-2DF8242IX-AELW	Versions which Build time before 210625	V5.5.800 build210628	https://us.hikvision.com/sites/default/files/firmware/ipd_h7_en_std_5.5.800_210628.zip
	DS-2DF6A836XS-AEL DS-2DF8442IXS-AELW DS-2DF8C842IXS-AELW	Versions which Build time before 210625	V5.5.801 build210628	https://us.hikvision.com/sites/default/files/firmware/ipd_h5_en_std_5.5.801_210628.zip
	DS-2DF9C245IHS-DLW	Versions which Build time before 210625	V5.5.801 build210701	https://us.hikvision.com/sites/default/files/firmware/ipdhg_h5_l1_en_std_5.5.801_210701.zip
Thermal Fixed Camera	DS-2TD1217-2/PA, DS-2TD1217-3/PA, DS-2TD1217-6/PA, DS-2TD2617-3/PA, DS-2TD2617-6/PA, DS-2TD2617-10/PA， DS-2TD2137-7/P, DS-2TD2637-10/P, DS-2TD2637-15/P, DS-2TD2637-25/P, DS-2TD2637-35/P, DS-2TD2667-15/P, DS-2TD2667-35/P	Versions which build time before 210702	V5.5.42 build 210721	https://us.hikvision.com/sites/default/files/firmware/iphc_h7_en_std_5.5.42_210721.zip
	DS-2TD1217-2/V1, DS-2TD1217-3/V1, DS-2TD1217-6/V1, DS-2TD2617-3/V1, DS-2TD2617-6/V1, DS-2TD2836-25/V1, DS-2TD2836-50/V1, DS-2TD2866-25/V1, DS-2TD2866-50/V1	Versions which build time before 210702	V5.5.22 build 210702	https://us.hikvision.com/sites/default/files/firmware/iptcs_h3_en_std_5....
	DS-2TD2117-3/V1, DS-2TD2117-6/V1, DS-2TD2136-7/V1, DS-2TD2136-10/V1, DS-2TD2136-15/V1, DS-2TD2136-25/V1, DS-2TD2136-35/V1, DS-2TD2137-7/V1, DS-2TD2137-15/V1, DS-2TD2137-25/V1, DS-2TD2166-7/V1, DS-2TD2166-15/V1, DS-2TD2166-25/V1, DS-2TD2166-35/V1, DS-2TD2615-7, DS-2TD2615-10, DS-2TD2636-10, DS-2TD2636-15, DS-2TD2836-25, DS-2TD2836-50, DS-2TD2866-25, DS-2TD2866-50	Versions which build time before 210702	V5.5.22 build 210702	https://us.hikvision.com/sites/default/files/firmware/iphc_h3_en_std_5.5.22_210702.zip
	DS-2TD2136-7, DS-2TD2136-10, DS-2TD2136-15, DS-2TD2136-25, DS-2TD2136-35, DS-2TD2166-7, DS-2TD2166-15, DS-2TD2166-25, DS-2TD2166-35, DS-2TD2136T-10, DS-2TD2136T-15, DS-2TD2136T-25, DS-2TD2166T-15, DS-2TD2166T-25, DS-2TD2336-50, DS-2TD2336-75, DS-2TD2336-100, DS-2TD2366-50, DS-2TD2366-75, DS-2TD2366-100, DS-2TD2466-25Y, DS-2TD2466-50Y	Versions which build time before 210702	V5.5.8 build 210702	https://us.hikvision.com/sites/default/files/firmware/iphc_h1_en_std_5.5...
Thermal PTZ Camera	DS-2TD4137-25/W, DS-2TD4167-50/W, DS-2TD6267-75C4L/W, DS-2TD6267-100C4L/W, DS-2TD8167-190ZE2F/W	Versions which build time before 210702	V5.5.33 build 210729	https://us.hikvision.com/sites/default/files/firmware/iptm_h5_en_std_5.5...
Thermal PTZ Camera	DS-2TD4136-25/V2, DS-2TD4136-50/V2, DS-2TD4166-25/V2, DS-2TD4166-50/V2, DS-2TD4237-10/V2, DS-2TD4237-25/V2, DS-2TD6236-50H2L/V2, DS-2TD6236-75C2L/V2, DS-2TD6266-100C2L/V2, DS-2TD6266-50H2L/V2, DS-2TD6266-75C2L/V2, DS-2TD8166-150ZE2F/V2, DS-2TD8166-180ZE2F/V2	Versions which build time before 210702	V5.5.39 build 210702	https://us.hikvision.com/sites/default/files/firmware/iptm_h3_en_std_5.5.39_210702.zip
HAT Camera	DS-2TD1217B-3/PA, DS-2TD1217B-6/PA, DS-2TD2617B-6/PA, DS-2TD2636B-13/P, DS-2TD2636B-15/P	Versions which build time before 210702	V5.5.34 build 210702	https://us.hikvision.com/sites/default/files/firmware/iptc_temp_h7_en_std_5.5.34_210702.zip
NVR	DS-7604NI-Q1/4P (C) DS-7608NI-Q2/8P (C) DS-7616NI-Q2/16P (C)	V4.30.210 Build201224 V4.30.216 build210111 V4.30.217 build210204 V4.31.100 build210511	V4.31.102 build210626	https://us.hikvision.com/sites/default/files/firmware/nvr_k9b2_bl_ml_std_v4.31.102_210626.zip

Precondition:

The attacker has access to the device network or the device has direct interface with the internet

Attack step:

Send a specially crafted message.

Obtaining fixed firmware:

Users should download the updated firmware to guard against this potential vulnerability. See above chart right column for download links.

FAQ:

Click here to Access the FAQ Document.

Source of vulnerability information:

This vulnerability is reported to HSRC by UK security researcher Watchful IP.

Should you have a security problem or concern, please contact Hikvision Security Response Center at hsrc@hikvision.com.

2021-09-23 V1.1 Update information of impacted product model/firmware versions and resolved versions.

2021-09-28 V1.2 Update information of impacted product model/affected versions/fix versions.

COMMAND INJECTION VULNERABILITY IN SOME HIKVISION PRODUCTS

SECURITY NOTIFICATION- COMMAND INJECTION VULNERABILITY IN SOME HIKVISION PRODUCTS

Get a better browsing experience