Vulnerabilities

Hikvision DVRs in Ukraine hit with a five-year-old exploit

GreyNoise saw a nine-day wave of CVE-2021-36260 attempts against Hikvision recorders in Ukraine. How the flaw works, who sent it, and what to check.

By Yaali. October 12, 2026, 7 min read, Vulnerabilities, Threat intel, Patching.

GreyNoise, which runs a network of internet sensors that record scanning and exploitation traffic, saw a sharp rise in attacks on Hikvision digital video recorders (DVRs) and IP cameras in Ukraine between September 21 and October 1, 2026. Almost all of it used CVE-2021-36260, a command injection flaw rated CVSS 9.8 that lets anyone who can reach the device's web port run commands as root without logging in. Hikvision fixed it in September 2021.

The traffic came from four IP addresses, three of them PureVPN exit nodes in Lithuania, and it only went to Ukrainian targets. GreyNoise notes the wave coincided with an escalation in Russian strikes but says it cannot tie the two together. If you run Hikvision recorders or cameras anywhere, and especially if any of them answer on the internet, check their firmware this week: the exploit is a public, ready-made scanner template that anyone can point at a new country.

Timeline of the activity: reconnaissance from a Ukrainian IP on September 21, near silence on September 22, a nine-day surge from September 23 to October 1 driven by three PureVPN exit nodes, and no further attempts as of October 7

How it works

Hikvision devices run an embedded web server for their admin interface. One of its handlers, the /SDK/webLanguage endpoint, accepts an HTTP PUT with a small XML body that sets the interface language. On vulnerable firmware the server does not validate that value before passing it to the operating system, so a shell command wrapped inside the language field gets executed. No session or password is checked first.

The command runs as root. The researcher who found the bug, known as Watchful IP, showed in 2021 that this goes well beyond the restricted "protected shell" Hikvision gives owners: an attacker can read /etc/passwd, add a root account, start an SSH server and bypass the web admin login. All it needs is access to the HTTP or HTTPS port, usually 80 or 443, and the camera itself keeps no log that would show the request.

The tool seen in Ukraine is the public Nuclei template for CVE-2021-36260 from ProjectDiscovery. Nuclei is a widely used open-source vulnerability scanner. Its template sends the PUT with a command that writes a random string to a file in the web root, then requests that file. If the string comes back, the device is vulnerable. That is a test, not a takeover, but it hands whoever ran it a list of exploitable devices.

Hikvision's advisory, HSRC-202109-01, treats firmware dated before 210628 (June 28, 2021) as affected for most camera lines, with a 210625 build cutoff for some DS-2CV models. Some NVRs (network video recorders) are affected too. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on January 10, 2022, after the Mirai-based Moobot botnet started using it to recruit cameras.

What attackers are doing

Attempts against Ukraine had been rare since early July, so the September spike stood out against a near-zero baseline. On September 21 one of the four addresses, sitting on a Ukrainian network, probed service ports in Ukraine without firing any exploit; GreyNoise rates its link to the others as low confidence. September 22 was almost silent. On September 23 the volume jumped from near zero, and from then until October 1 the four addresses sent almost all of the activity. That nine-day run is the surge. GreyNoise recorded the last attempt from those addresses on October 1 and saw nothing further from them through October 7.

The three Lithuanian addresses (195.238.124.178, 195.238.124.181 and 195.238.124.188) sit on AS56630, which GreyNoise describes as commercial VPN exits used by PureVPN. GreyNoise assesses the PureVPN activity as the work of a single entity, and treats the Ukrainian domestic address as possibly related but with low confidence. It also cautions that PureVPN is a shared commercial service, so the exits may carry unrelated traffic too.

Every recorded request from the four addresses was the same test command, with nothing staged to install and no follow-on payload. GreyNoise found no confirmed compromise of any camera or recorder. This was reconnaissance: mapping which devices in Ukraine are exploitable, not taking them over in the act. Separately, GreyNoise saw a broad global rise in CVE-2021-36260 scanning over the same stretch, but the four Ukraine addresses did not touch its sensors anywhere else.

Why cameras matter here is not abstract. In January 2024 Ukraine's security service, the SBU, said Russian intelligence had taken over two residential webcams in Kyiv, changed their angles and streamed the feeds to help direct a missile strike, and that it had since blocked roughly 10,000 IP cameras that could be used that way. GreyNoise points at that pattern, surveying an area before, during and after a strike, as one plausible use of compromised recorders, while stating plainly that it cannot attribute this wave to any actor.

What to do

Prioritised actions for Hikvision owners: inventory devices and their firmware build date, patch anything older than build 210628, take recorders off the public internet, and check for signs of past compromise such as unknown accounts or a running SSH service

1. Find your devices and their build date

List every Hikvision camera, DVR and NVR on your network. In the web interface each device shows its firmware under Configuration > System > System Settings > Basic Information; the build date is the six-digit number at the end of the version string (for example build 210628). Anything built before 210628 (June 28, 2021), or before 210625 on the DS-2CV camera lines, is in scope for CVE-2021-36260. If you cannot log in to check, treat the device as vulnerable until proven otherwise.

2. Patch, then cut off internet exposure

Download the latest firmware for each exact model from Hikvision's support site, using the serial-number lookup, and upgrade. If a device is too old to have a fix, retire it. Hikvision's fixes for this flaw start at build 210628.

Patching is only half the job. These recorders should not answer on the public internet at all. Remove any port-forwarding or UPnP rule that exposes a camera or DVR web port (80, 443, 8000) to the outside, and reach them remotely only over a VPN. Put cameras on their own network segment, and block the recorders from making outbound connections to the internet so a compromised one cannot be driven or stream out. A device that only an internal admin host can reach is not exposed to a scan like this one.

3. Check whether you were already hit

Because the flaw predates this wave by years, an exposed device may have been taken over long before September. Look for:

Accounts you did not create. Review the user list in the web interface and remove any unfamiliar operator or admin account.
An SSH service running on a device where you never enabled one, or Telnet left open. Scan the camera's own IP from inside your network and investigate any open port you cannot explain.
Outbound connections from cameras or recorders in your firewall logs, especially to unfamiliar addresses, which point to botnet or exfiltration activity.
The four source addresses above in any firewall or edge logs covering late September.

If you find any of these, treat the device as compromised: pull it offline, factory reset it, upgrade the firmware before reconnecting, and set a fresh strong admin password. The device keeps no log of the original exploit request, so the account, service and network checks above are what you have to rely on.

The wider lesson

CVE-2021-36260 has a patch, a CISA deadline that passed in January 2022 and a long record of botnet abuse, yet it still finds targets in 2026. The reason is that cameras and recorders are installed once and rarely revisited, and many sit directly on the internet because that was the easiest way to get remote viewing working. An old flaw with a public one-line scanner template does not go away; it waits for the next operator to point it at a list of IP ranges. Inventory and segmentation for these devices matter as much as the patch.

Our network penetration tests look for exactly this kind of forgotten device answering where it should not, and our attack surface management work keeps that external view current as cameras and recorders come and go. Open the chat and Yaali, our AI agent, will pass your question to the engineer who would do the work.

Sources: GreyNoise blog, Risky Bulletin (Risky.biz), dev.ua, Cybernews, Hikvision security advisory HSRC-202109-01, Watchful IP disclosure, CISA Known Exploited Vulnerabilities catalog, The Record (SBU webcams).