CVE report
CVE-2021-36260criticalKEV
Hikvision IP camera/NVR - Remote Command Execution
Events 90d
20,183
Distinct IPs
30
Severity
critical
CISA KEV
Actively exploited
Detection signature
An event counts toward CVE-2021-36260 when its URL path contains any of these (case-insensitive). This is what our matching is based on.
- · /SDK/webLanguage
Pre-disclosure activity
all early actors →Analysing probe history around the publication date…
Recent probe volume (last 7 days)
peak: 579 events/dayeventsdistinct IPs
Downloads & integrations
Top sources probing for CVE-2021-36260
- 93.123.72.1834,167 eventsNetherlands· Amarutu Technology Ltd
- 5.61.209.922,996 eventsSeychelles· Amarutu Technology Ltd
- 31.59.160.122,229 eventsUnited Arab Emirates
- 204.76.203.2061,765 eventsNetherlands· Pfcloud UG (haftungsbeschrankt)
- 5.61.209.431,656 eventsSeychelles· Amarutu Technology Ltd
- 204.76.203.2191,432 eventsNetherlands· Pfcloud UG (haftungsbeschrankt)
- 195.182.16.231,249 eventsGermany· Amarutu Technology Ltd
- 94.154.43.2431,132 eventsThe Netherlands· Storm Industries LLC
- 5.61.209.1261,068 eventsSeychelles· Amarutu Technology Ltd
- 45.139.122.80494 eventsThe Netherlands· Amarutu Technology Ltd
- 5.61.209.102386 eventsSeychelles· Amarutu Technology Ltd
- 204.76.203.36329 eventsNetherlands· Pfcloud UG (haftungsbeschrankt)
- 5.61.209.44316 eventsSeychelles· Amarutu Technology Ltd
- 91.224.92.32260 eventsUnited Kingdom· UAB Host Baltic
- 5.61.209.96155 eventsSeychelles· Amarutu Technology Ltd
- 5.61.209.33152 eventsSeychelles· Amarutu Technology Ltd
- 5.61.209.107127 eventsSeychelles· Amarutu Technology Ltd
- 192.142.24.6677 eventsNetherlands· Hostpalace Datacenters Ltd
- 5.61.209.8860 eventsSeychelles· Amarutu Technology Ltd
- 192.142.24.6052 eventsNetherlands· Hostpalace Datacenters Ltd
- 104.194.10.14339 eventsUnited States· ReliableSite.Net LLC
- 37.49.225.4419 eventsThe Netherlands· ESTOXY OU
- 185.125.201.7910 eventsRussia· Timeweb, LLP
- 192.142.24.434 eventsNetherlands· Hostpalace Datacenters Ltd
- 45.198.224.812 eventsSweden
- 101.36.125.582 eventsHong Kong· UCLOUD INFORMATION TECHNOLOGY HK LIMITED
- 87.237.54.1912 eventsGermany· ZAP-Hosting GmbH
- 23.95.5.2121 eventsUnited States· HostPapa
- 45.153.34.2311 eventsThe Netherlands· TechTies Inc.
- 93.123.72.1661 eventsNetherlands· Amarutu Technology Ltd
Top networks the attempts come from
- AS206264 Amarutu Technology Ltd13 IPs · 12,827 ev
- AS51396 Pfcloud UG (haftungsbeschrankt)3 IPs · 3,526 ev
- AS203861 Miteflux Technologies Ltd1 IPs · 1,189 ev
- AS219502 Storm Industries LLC1 IPs · 1,132 ev
- AS209605 UAB Host Baltic1 IPs · 260 ev
- AS60064 Hostpalace Datacenters Ltd3 IPs · 133 ev
- AS23470 ReliableSite.Net LLC1 IPs · 39 ev
- AS61254 ESTOXY OU1 IPs · 19 ev
- AS210976 Timeweb, LLP1 IPs · 10 ev
- AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED1 IPs · 2 ev
Fingerprints of the clients exploiting this
The HTTP (JA4H) and TLS (JA4) fingerprints seen on these attempts. Click one to see the whole population that carries it.
ja4h: ge11nn0300_86b6b04cb9ccja4h: ge11nn09en_5f96af7f1814ja4h: pu11nn0400_fdcc3615ee04ja4h: ge11nn15en_a743836884dfja4h: ge11nn0400_17292dadbc7bja4h: pu11nn0600_5aaf82b7b36cja4: t13i250900_b78ed14e2fd0_e7c285222651ja4: t13i131000_f57a46bbacb6_e5728521abd4ja4: t13i130900_f57a46bbacb6_e7c285222651ja4: t13i190800_9dc949149365_97f8aa674fd9ja4: t13i131000_f57a46bbacb6_ab7e3b40a677
Sample request paths observed
- /SDK/webLanguage