CVE-2023-6895
MEDIUM EXPLOITED NUCLEIHikvision Intercom Broadcast System < 4.1.0 - OS Command Injection
Title source: ruleDescription
A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK). It has been declared as critical. This vulnerability affects unknown code of the file /php/ping.php. The manipulation of the argument jsondata[ip] with the input netstat -ano leads to os command injection. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.0 is able to address this issue. It is recommended to upgrade the affected component. VDB-248254 is the identifier assigned to this vulnerability.
Exploits (2)
Nuclei Templates (1)
Hikvision IP ping.php - Command Execution
CRITICALVERIFIEDby DhiyaneshDk,archer
Shodan:
http.favicon.hash:"-1830859634"
FOFA:
icon_hash="-1830859634"
Scores
CVSS v3
6.3
EPSS
0.9324
EPSS Percentile
99.8%
Attack Vector
ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Details
VulnCheck KEV
2026-02-23
CWE
CWE-78
Status
published
Products (1)
hikvision/intercom_broadcast_system
3.0.3 - 4.1.0
Published
Dec 17, 2023
Tracked Since
Feb 18, 2026