Not scored
CVE-2023-6895
Hikvision Intercom Broadcasting System ping.php os command injection
HikvisionIntercom Broadcasting System
Status
- Not in CISA KEV
Exploit probabilityEPSSchecked 25 Oct
89%probability of exploitation in the next 30 days
Higher than 100% of scored CVEs
SeverityCVSS
–Not scored yet
Description NVD
A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK). It has been declared as critical. This vulnerability affects unknown code of the file /php/ping.php. The manipulation of the argument jsondata[ip] with the input netstat -ano leads to os command injection. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.0 is able to address this issue. It is recommended to upgrade the affected component. VDB-248254 is the identifier assigned to this vulnerability.
Coverage 3 articles · 3 outlets
See the full timelineShow as table
| Published (UTC) | Outlet | Headline |
|---|---|---|
| Wed 4 Mar · 03:57 UTC | Check Point | Iranian actors exploit Hikvision and Dahua IP cameras via CVEs |
| Fri 6 Mar · 14:34 UTC | Dark Reading | Iran weaponises cameras with CVEs to plan missile strikes |
| Sat 7 Mar · 10:55 UTC | Security Affairs | Iran-linked actors scan Hikvision and Dahua cams via VPN for CVEs |
- Iran-linked actors scan Hikvision and Dahua cams via VPN for CVEsSecurity Affairs · mentions it in passing
- Iran weaponises cameras with CVEs to plan missile strikesDark Reading · mentions it in passing
- Iranian actors exploit Hikvision and Dahua IP cameras via CVEsCheck Point · first in our coverage · mentions it in passing