Hikvision IP Camera/NVR Web Server Unauthenticated Command Injection

#!/usr/bin/env bash
# check_hikvision_cve2021_36260.sh
# Checks if a Hikvision camera is vulnerable to CVE-2021-36260
# by querying the device info endpoint for firmware build date.
# Safe, non-exploitative check. No authentication required for this endpoint.
# Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN

set -euo pipefail

TARGET="${1:-}"
PORT="${2:-80}"

if [[ -z "$TARGET" ]]; then
  echo "Usage: $0 <camera-ip-or-hostname> [port]"
  echo "Example: $0 192.168.1.100 80"
  exit 2
fi

URL="http://${TARGET}:${PORT}/System/deviceInfo"
echo "[*] Querying device info at ${URL} ..."

RESPONSE=$(curl -sk --connect-timeout 10 --max-time 15 "$URL" 2>/dev/null || true)

if [[ -z "$RESPONSE" ]]; then
  # Try HTTPS
  URL="https://${TARGET}:${PORT}/System/deviceInfo"
  echo "[*] HTTP failed, trying HTTPS at ${URL} ..."
  RESPONSE=$(curl -sk --connect-timeout 10 --max-time 15 "$URL" 2>/dev/null || true)
fi

if [[ -z "$RESPONSE" ]]; then
  echo "UNKNOWN - Could not connect to ${TARGET}:${PORT}"
  exit 2
fi

# Check if this is a Hikvision device
if ! echo "$RESPONSE" | grep -qi "hikvision\|hikdigital\|DeviceInfo"; then
  echo "UNKNOWN - Device at ${TARGET}:${PORT} does not appear to be a Hikvision product"
  exit 2
fi

# Extract firmware version and build date
FW_VERSION=$(echo "$RESPONSE" | grep -oP '<firmwareVersion>[^<]+' | sed 's/<firmwareVersion>//' || true)
BUILD=$(echo "$RESPONSE" | grep -oP '<firmwareReleasedDate>[^<]+' | sed 's/<firmwareReleasedDate>//' || true)
MODEL=$(echo "$RESPONSE" | grep -oP '<model>[^<]+' | sed 's/<model>//' || true)

echo "[*] Model: ${MODEL:-unknown}"
echo "[*] Firmware: ${FW_VERSION:-unknown}"
echo "[*] Build date: ${BUILD:-unknown}"

if [[ -z "$BUILD" && -z "$FW_VERSION" ]]; then
  echo "UNKNOWN - Could not extract firmware version or build date"
  exit 2
fi

# Check build date - vulnerable if before 210628
# Build dates are typically in format YYMMDD or embedded in version string
BUILD_NUM=$(echo "$BUILD $FW_VERSION" | grep -oP '2[0-9]{5}' | head -1 || true)

if [[ -z "$BUILD_NUM" ]]; then
  echo "UNKNOWN - Could not parse build date from firmware string"
  exit 2
fi

echo "[*] Parsed build number: ${BUILD_NUM}"

if [[ "$BUILD_NUM" -lt 210628 ]]; then
  echo ""
  echo "VULNERABLE - Firmware build ${BUILD_NUM} predates the CVE-2021-36260 fix (210628)"
  echo "ACTION: Update firmware immediately. Download from:"
  echo "  https://www.hikvision.com/en/support/cybersecurity/security-advisory/"
  exit 0
else
  echo ""
  echo "PATCHED - Firmware build ${BUILD_NUM} includes the CVE-2021-36260 fix"
  exit 1
fi