Vulnerabilities > CVE-2023-6895 - Unspecified vulnerability in Hikvision Intercom Broadcast System

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

hikvision

critical

NVD

Published: 2023-12-17

Updated: 2024-11-21

Summary

A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK). It has been declared as critical. This vulnerability affects unknown code of the file /php/ping.php. The manipulation of the argument jsondata[ip] with the input netstat -ano leads to os command injection. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.0 is able to address this issue. It is recommended to upgrade the affected component. VDB-248254 is the identifier assigned to this vulnerability.

Vulnerable Configurations

Part	Description	Count
OS	Hikvision Hikvision Intercom Broadcast System *	1
Hardware	Hikvision Hikvision DS KD BK - Hikvision DS KD DIS - Hikvision DS KD E - Hikvision DS KD IN - Hikvision DS KD Info - Hikvision DS KD KK - Hikvision DS KD Kk/S - Hikvision DS KD KP - Hikvision DS KD Kp/S - Hikvision DS KD M - Hikvision DS Kd3003 E6 - Hikvision DS Kd8003Ime1(B) - Hikvision DS Kd8003Ime1(B)/Flush - Hikvision DS Kd8003Ime1(B)/Ns - Hikvision DS Kd8003Ime1(B)/S - Hikvision DS Kd8003Ime1(B)/Surface - Hikvision DS Kh6220 LE1 - Hikvision DS Kh6320 LE1 - Hikvision DS Kh6320 Tde1 - Hikvision DS Kh6320 TE1 - Hikvision DS Kh6320 Wtde1 - Hikvision DS Kh6320 Wte1 - Hikvision DS Kh6350 Wte1 - Hikvision DS Kh6351 TE1 - Hikvision DS Kh6351 Wte1 - Hikvision DS Kh63Le1(B) - Hikvision DS Kh8520 Wte1 - Hikvision DS Kh9310 Wte1(B) - Hikvision DS Kh9510 Wte1(B) -	29

Summary

Vulnerable Configurations

References