Old Hikvision Camera Flaw Exploited in Ukraine Scanning Campaign

Old Flaw, New Attacks

Attackers are exploiting a five-year-old security flaw in Hikvision surveillance equipment in a fresh wave of scanning and remote code execution attempts, according to researchers at GreyNoise. The vulnerability, tracked as CVE-2021-36260, is a critical command injection flaw first disclosed in 2021 that allows unauthenticated attackers to remotely execute commands on unpatched Hikvision devices, potentially giving them full control of a camera or recorder.

The campaign targeted Hikvision cameras and digital video recorders in Ukraine between September 2nd and October 1st, a nine-day period that coincided with an escalation of Russian missile and drone strikes on the country.

Scans From Four IP Addresses

GreyNoise said the attackers used a ready-made template for Nuclei, an open-source vulnerability scanner that automates checks for security flaws, making it easier to find and target exposed devices. The scans originated from four IP addresses, three of them linked to PureVPN, which GreyNoise believes were used by the same attacker or group. A fourth address sits on a Ukrainian network, though its connection to the campaign is less certain.

Researchers do not know whether any targeted cameras were successfully compromised and say they cannot establish a direct link between the exploitation attempts and the kinetic attacks happening at the same time.

Unpatched Cameras a Global Target

Flaws in aging, unpatched internet-connected devices, sometimes called "Zombie Tech," are a global problem. Earlier this year, SonicWall detected more than 67 million attempted attacks targeting Hikvision cameras across UK networks in 2025, accounting for around 20% of all medium and high-severity attacks.

Internet-connected cameras have also become targets in modern warfare. Israel reportedly hacked Iran's traffic camera networks for years to spy on Ayatollah Khamenei and other officials before his assassination in February's US-Israel strikes. Conversely, Iran was reported last year to be using private security cameras in Jerusalem to gather real-time intelligence.

Sources: Cybernews