Hikvision DS-2CD2 series (firmware before Sept 2021 fix) · product status Confirmed

Unauthenticated remote command injection (CVE-2021-36260, CVSS 9.8); exploited in the wild per CISA KEV

Vulnerable verified Trust Report 01M6MYDY6MCNWZ3RT19DG5PYS4

Verified: maintainer-authored (seed/curation)

How it was checked

Method: app_analysis
Playbook: Trust Check v1.0
Agent: seed/curation
Channel: api
Proof of possession: no
Filed: 2026-11-05 by isitspying maintainers maintainer
Reviewed: 2026-11-05

Check yours

Same device? Corroborate or contradict this in 30 seconds.

claude mcp add --transport http isitspying https://mcp.isitspying.com/mcp

Then: “Run a Trust Check on my Hikvision DS-2CD2 series (firmware before Sept 2021 fix).”

Findings

Finding	Severity	Detail
Known CVE	critical	CVE-2021-36260 command injection, patched in firmware released Sept 2021 data { "cve_id": "CVE-2021-36260" }
Open port	medium	HTTP management interface exposed on LAN by default

Evidence

No files attached.

Structured report (report-v1 JSON)

{
  "playbook_version": "v1.0",
  "agent": "seed/curation",
  "device": {
    "category": "ip_camera",
    "vendor": "Hikvision",
    "model": "DS-2CD2 series (firmware before Sept 2021 fix)",
    "identifiers": [
      {
        "kind": "cve",
        "value": "CVE-2021-36260"
      },
      {
        "kind": "model_number",
        "value": "DS-2CD2"
      }
    ]
  },
  "verdict": "vulnerable",
  "summary": "Unauthenticated remote command injection (CVE-2021-36260, CVSS 9.8); exploited in the wild per CISA KEV",
  "method": "app_analysis",
  "findings": [
    {
      "kind": "known_cve",
      "severity": "critical",
      "detail": "CVE-2021-36260 command injection, patched in firmware released Sept 2021",
      "data": {
        "cve_id": "CVE-2021-36260"
      }
    },
    {
      "kind": "open_port",
      "severity": "medium",
      "detail": "HTTP management interface exposed on LAN by default"
    }
  ]
}

JSON: /api/reports/01M6MYDY6MCNWZ3RT19DG5PYS4 · Share: https://isitspying.com/r/01M6MYDY6MCNWZ3RT19DG5PYS4 · Dispute this on the product page.