Vulnerability threat dossier
A command injection vulnerability in the web server of some Hikvision product. Due to the insufficient input validation, attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands.
VTP analyst assessment
CISA KEV lists this Hikvision vulnerability as known to be exploited globally. Public exploit tooling is reported. The available press source describes a botnet, but its supplied summary does not name this CVE.
1 record references and 1 source references passed trusted post-response validation. The current deterministic record contains 0 independent evidence groups.
The tooling evidence does not prove reliable exploitation.
We do not know whether affected cameras are present, exposed, or configured in this environment.
No VTP sensor telemetry is available.
First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.
Review in your environment: if you use affected Hikvision cameras, check web-server exposure and patch status.
VTP deterministic assessment
CISA KEV lists this vulnerability as known to be exploited globally.
A proof of concept is reported; functional reliability is not established.
EPSS is 1.00; this is predictive context, not exploitation evidence.
First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.
Material change ledger
Claim provenance
0 primary sources · 0 dependent secondary reports · 1 reports with unresolved independence. Repetition remains visible without multiplying confirmation.
Event history
Greenbone Community Feed published new or materially changed exploit-oriented tooling for this CVE. This is availability evidence, not evidence of exploitation in the wild.
CISA lists global known exploitation. This is not a VTP sensor observation.
Original publications
Greenbone Community Feed recorded exploit-tooling coverage changes for 6 CVEs in this pinned revision. 6 have an active availability assertion for this revision. Tooling evidence does not establish exploitation in the wild or successful execution.
Cybersecurity researchers have flagged a previously undocumented Linux botnet family dubbed Evooo1Bot that derives its core functionality from the Mirai botnet source code and is equipped to turn internet-facing devices into SOCKS proxies. "While the malware reuses the DDoS engine from the publicly leaked Mirai source code, it extends the original framework with numerous capabilities, including
Technical vulnerability data
Raw observations
First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.