安全通告
海康威视多个产品命令注入漏洞
安全风险通告
发布日期：2021-9-23
漏洞描述
近日，监测到海康威视发布安全公告，修复了海康威视多个产品中的命令注入漏洞。海康威视部分产品中的web模块存在一个命令注入漏洞，由于对输入参数校验不充分，攻击者可以发送带有恶意命令的报文到受影响设备，成功利用此漏洞可以导致命令执行。
海康威视是以视频为核心的智能物联网解决方案和大数据服务提供商，业务聚焦于综合安防、大数据服务和智慧业务。
漏洞编号
CVE-2021-36260
漏洞危害
攻击者可通过该漏洞在受影响的设备上进行任意命令执行
漏洞等级
高危
受影响版本
1.易受攻击的网络摄像机固件
| 产品类型 | 影响版本 |
| IPC_E0 | IPC_E0_CN_STD_5.4.6_180112 |
| IPC_E1 | 未知 |
| IPC_E2 | IPC_E2_EN_STD_5.5.52_180620 |
| IPC_E4 | 未知 |
| IPC_E6 | IPCK_E6_EN_STD_5.5.100_200226 |
| IPC_E7 | IPCK_E7_EN_STD_5.5.120_200604 |
| IPC_G3 | IPC_G3_EN_STD_5.5.160_210416 |
| IPC_G5 | IPC_G5_EN_STD_5.5.113_210317 |
| IPC_H1 | IPC_H1_EN_STD_5.4.61_181204 |
| IPC_H5 | IPCP_H5_EN_STD_5.5.85_201120 |
| IPC_H8 | Factory installed firmware mid 2021 |
| IPC_R2 | IPC_R2_EN_STD_V5.4.81_180203 |
2.易受攻击的 PTZ 摄像机固件
| 产品类型 | 影响版本 |
| IPD_E7 | IPDEX_E7_EN_STD_5.6.30_210526 |
| IPD_G3 | IPDES_G3_EN_STD_5.5.42_210106 |
| IPD_H5 | IPD_H5_EN_STD_5.5.41_200911 |
| IPD_H7 | IPD_H7_EN_STD_5.5.40_200721 |
| IPD_H8 | IPD_H8_EN_STD_5.7.1_210619 |
3.易受攻击的旧固件
| 产品类型 | 影响版本 |
| IPC_R7 | 5.4.x |
| IPD_R7 | |
| IPC_G0 | |
| IPC_H3 | |
| IPD_H3 |
4.OEM 固件
修复方案
1、海康威视已发布版本修复该漏洞，请受影响用户尽快根据漏洞影响范围，及时更新至安全版本。
参考链接
- https://www.hikvision.com/cn/support/CybersecurityCenter/SecurityNotices/20210919/
- 各受影响的产品版本与修复程序下载链接如下：
| 序号 | 产品名称 | 受影响版本号 | 修复程序下载 |
| 1 | DS-2CVxxxx | 版本build日期在210625之前 | https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/01%EF%BC%9ADS-2CVxxxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip |
| 2 | DS-2CD1xxx | https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/02%EF%BC%9ADS0-2CD1xxxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 3 | IPCxx | https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/03%EF%BC%9AIPCxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 4 | DS-IPC-Bxx
DS-IPC-Txx |
https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/05%EF%BC%9ADS-IPC-Exx%E3%80%81Sxx%E3%80%81Axx%E3%80%81DS-2XDxxxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 5 | DS-IPC-Exx
DS-IPC-Sxx DS-IPC-Axx DS-2XDxxxx |
https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/05%EF%BC%9ADS-IPC-Exx%E3%80%81Sxx%E3%80%81Axx%E3%80%81DS-2XDxxxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 6 | DS-2CD2xxx | https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/06%EF%BC%9ADS-2CD2xxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 7 | DS-2CD3xxx | https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/07%EF%BC%9ADS-2CD3xxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 8 | (i)DS-2DCxxxx | https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/08%EF%BC%9A(i)DS-2DCxxxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 9 | (i)DS-2DExxxx | https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/09%EF%BC%9A(i)DS-2DExxxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 10 | (i)DS-2PTxxxx | https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/10%EF%BC%9A(i)DS-2PTxxxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 11 | (i)DS-2SE7xxxx | https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/11%EF%BC%9A(i)DS-2SE7xxxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 12 | DS-2DBxxxx | https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/12%EF%BC%9ADS-2DBxxxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 13 | DS-2DYHxxxx | https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/13%EF%BC%9ADS-2DYHxxxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 14 | DS-DY9xxxx | https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/14%EF%BC%9ADS-2DY9xxxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 15 | iDS-2DY5Cxxx | https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/15%EF%BC%9AiDS-2DY5Cxxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 16 | iDS-2DP9Cxxx-T4 | https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/16%EF%BC%9AiDS-2DP9Cxxx-T4%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 17 | DS-2DY7xxx-CX(S5)
DS-2DF6xxx-CX(S6) DS-2DF6Cxxx-CX(T2) |
https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/17%EF%BC%9ADS-2DY7xxx-CX%EF%BC%88S5%EF%BC%89%E3%80%812DF6xxx-CX%EF%BC%88S6%EF%BC%89%E3%80%812DF6Cxxx-CX%EF%BC%88T2%EF%BC%89%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 18 | iDS-2VY4xxxx | https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/18%EF%BC%9AiDS-2VY4xxxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 19 | iDS-EGDxxxx | https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/19%EF%BC%9AiDS-EGDxxxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 20 | DS-2CD4xxx
DS-2CD5xxx |
https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/20%EF%BC%9ADS-2CD4xxx%E3%80%815xxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 21 | DS-2CD6xxx | https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/21%EF%BC%9ADS-2CD6xxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 22 | DS-2CD7xxx
DS-GPZxxx |
https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/22%EF%BC%9ADS-2CD7xxx%E3%80%81DS-GPZxxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 23 | DS-2CD8xxx | https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/23%EF%BC%9ADS-2CD8xxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 24 | DS-2XA8xxx | https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/24%EF%BC%9ADS-2XA8xxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 25 | DS-FCNxxxx | https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/25%EF%BC%9ADS-FCNxxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 26 | iDS-2XM/CD6xxx | https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/26%EF%BC%9AiDS-2XM%E3%80%81CD6xxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 27 | DS-2DF5xxxx
DS-2DF6xxxx DS-2DF6xxxx-Cx DS-2DF7xxxx DS-2DF8xxxx DS-2DF9xxxx |
https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/27%EF%BC%9ADS-2DF5%E3%80%816%E3%80%817%E3%80%818%E3%80%819xxx%E7%B3%BB%E5%88%97%E3%80%81DS-2DF6xxx-CX%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 28 | iDS-2VPDxxxx
iDS-2DPxxxx |
https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/28%EF%BC%9AiDS-2VPDxxxx%E3%80%812DPxxxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 29 | iDS-2PT9xxxx | https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/29%EF%BC%9AiDS-2PT9xxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 30 | iDS-2SK7xxxx
iDS-2SK8xxxx |
https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/30%EF%BC%9AiDS-2SK7%E3%80%818xxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 31 | iDS-2SR8xxxx | https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/31%EF%BC%9AiDS-SR8xxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 32 | iDS-2VSxxxx | https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/32%EF%BC%9AiDS-2VSxxxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 33 | iDS-2VTxxxx | https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/33%EF%BC%9AiDS-2VTxxxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 34 | iDS-GPZ2xxxx | https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/34%EF%BC%9AiDS-GPZ2xxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 35 | DS-2XE62x7FWD(D)
DS-2XE30x6FWD(B) DS-2XE60x6FWD(B) DS-2XE62x2F(D) DS-2XC66x5G0 DS-2XE64x2F(B) |
https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/35%EF%BC%9ADS-2XE%E3%80%81XC6xxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 36 | KBA18(C)-83x6FWD | https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/36%EF%BC%9AKBA18%EF%BC%88C%EF%BC%89-8xxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 37 | DS-2TBxxx
DS-Bxxxx DS-2TDxxxxB TBC-12xxx TBC-26xxx |
版本build日期在210702之前 | https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/37%EF%BC%9ADS-TBxxx%E3%80%81DS-Bxxxx%E3%80%81DS-2TDxxxxB%E3%80%81TBC-12xxx%E3%80%81TBC-26xxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip |
| 38 | DS-2TD1xxx-xx
DS-2TD2xxx-xx |
https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/38%EF%BC%9ADS-TD1xxx%E3%80%81DS-2TD2xxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 39 | DS-2TD51xx-xx/W/GLT
DS-2TD55xx-xx/W DS-2TD65xx-xx/W |
https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/39%EF%BC%9ADS-2TD51xx-xx%E3%80%81DS-2TD55xx-xx%E3%80%81DS-2TD65XX-XX%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 40 | DS-2TD41xx-xx/Wxx
DS-2TD62xx-xx/Wxx DS-2TD81xx-xx/Wxx DS-2TD91xx-xx/W DS-2TD4xxx-xx/V2 DS-2TD55xx-xx/V2 DS-2TD6xxx-xx/V2 DS-2TD81xx-xx/V2 DS-2TD91xx-xx/V2 |
https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/40%EF%BC%9ADS-2TD41xx-xx%E3%80%81DS-TD62xx-xx%E3%80%81DS-2TD81xx-xx%E3%80%81DS-2TD91xx%E3%80%81DS-2TD4xxx%E3%80%81DS-2TD55xx%E3%80%81DS-TD6xxx%E7%B3%BB%E5%88%97%E5%8D%87%E7%BA%A7%E5%8C%85.zip | |
| 41 | DS-76xxN-Exx
DS-78xxN-Kxx DS-NVR-K1xx DS-NVR-K2xx |
V4.30.210 Build201224-
V4.31.000 Build210511 |
https://hiknow-cn-s3.s3.cn-north-1.amazonaws.com.cn/41%EF%BC%9ADS-76xxN-Exxxxx%E3%80%81DS-78xxN-Kxxxxx%E3%80%81DS-NVR-K1xx%E3%80%81DS-NVR-K2xx.zip |