CVE-2023-6895

MEDIUM EXPLOITED NUCLEI

Hikvision Intercom Broadcast System < 4.1.0 - OS Command Injection

Title source: rule

Description

A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK). It has been declared as critical. This vulnerability affects unknown code of the file /php/ping.php. The manipulation of the argument jsondata[ip] with the input netstat -ano leads to os command injection. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.0 is able to address this issue. It is recommended to upgrade the affected component. VDB-248254 is the identifier assigned to this vulnerability.

Exploits (2)

nomisec WORKING POC 5 stars
by FuBoLuSec · remote
https://github.com/FuBoLuSec/CVE-2023-6895
nomisec SCANNER
by nles-crt · remote
https://github.com/nles-crt/CVE-2023-6895

Nuclei Templates (1)

Hikvision IP ping.php - Command Execution
CRITICALVERIFIEDby DhiyaneshDk,archer
Shodan: http.favicon.hash:"-1830859634"
FOFA: icon_hash="-1830859634"

Scores

CVSS v3 6.3
EPSS 0.9324
EPSS Percentile 99.8%
Attack Vector ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Details

VulnCheck KEV 2026-02-23
CWE
CWE-78
Status published
Products (1)
hikvision/intercom_broadcast_system 3.0.3 - 4.1.0
Published Dec 17, 2023
Tracked Since Feb 18, 2026