CVE-2023-6895 json
Hikvision Intercom Broadcasting System ping.php os command injection
published 2023-12-17 2 y ago modified 2026-06-17 4 mo ago also EUVD-2023-59096
- cvss
- 6.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 89.0%
- EPSS 89.0% chance of exploitation in 30 days, percentile 99.7%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK). It has been declared as critical. This vulnerability affects unknown code of the file /php/ping.php. The manipulation of the argument jsondata[ip] with the input netstat -ano leads to os command injection. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.0 is able to address this issue. It is recommended to upgrade the affected component. VDB-248254 is the identifier assigned to this vulnerability.
Patch / fix
- hikvision intercom_broadcast_system 4.1.0
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 23 mo ago
Exploit prediction
89.03% chance of exploitation in the next 30 days, higher than 99.7% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template Hikvision IP ping.php - Command Execution nuclei detection template
- github.com https://github.com/willchen0011/cve/blob/main/rce.md referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.3 | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
| CNA | 3.0 | 6.3 | CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
| CNA | 2.0 | 5.8 | AV:A/AC:L/Au:N/C:P/I:P/A:P |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Hikvision Intercom Broadcasting System
Classification
- Weakness
-
- CWE-78 Improper Neutralization of Special Elements used in an OS Command
References
-
github.com
/willchen0011/cve/blob/main/rce.md
exploit, third-party-advisory
-
vuldb.com
/?id.248254
vdb-entry, technical-description, third-party-advisory
-
vuldb.com
/?ctiid.248254
signature, permissions-required, third-party-advisory
Sources
- CVE List CVE-2023-6895
- NVD CVE-2023-6895
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.