Threat Intelligence / CVE / CVE-2023-6895

CVE-2023-6895 — Hikvision Intercom Broadcast System

CVSS v3.1 6.3 (MEDIUM) · EPSS 93.2% (higher than 99.8% of all scored CVEs) · Priority 7.1/10 · Published 2023-12-17

As of 2024-11-21, CVE-2023-6895 is a MEDIUM-severity vulnerability in Hikvision Intercom Broadcast System, CVSS v3.1 6.3, EPSS 93.2% (99.8th percentile). Threadlinqs Intelligence links 2 tracked threat campaigns to CVE-2023-6895, most recently “Seedworm (MuddyWater) Iranian MOIS APT Deploys Dindoor and Fakeset Backdoors Against U.S. Bank, Airport, and Defense Software Company”.

Last updated: 2024-11-21

What is CVE-2023-6895?

A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK). It has been declared as critical. This vulnerability affects unknown code of the file /php/ping.php. The manipulation of the argument jsondata[ip] with the input netstat -ano leads to os command injection. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.0 is able to address this issue. It is recommended to upgrade the affected component. VDB-248254 is the identifier assigned to this vulnerability.

The record classifies CVE-2023-6895 under weakness class CWE-78. Its CVSS v3 base vector states that the flaw is reachable from an adjacent network, needs no prior authentication, needs no user interaction. 30 affected-product entries are recorded, across 1 vendor, listed below. The identifier was first published 1001 days ago.

Severity and exploitation probability

CVSS v3.1 base score: 6.3 — MEDIUM
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS (FIRST): 93.2% probability of exploitation in the next 30 days, higher than 99.8% of all scored CVEs
CISA KEV: Not listed in the CISA Known Exploited Vulnerabilities catalog
Threadlinqs priority: 7.1/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
Published: 2023-12-17, last modified 2024-11-21

Is CVE-2023-6895 being exploited?

It currently carries a trending score of 30 in the Threadlinqs vulnerability feed.

Affected products and versions

Hikvision: Intercom Broadcast System, Ds-kd-bk, Ds-kd-dis, Ds-kd-e, Ds-kd-in, Ds-kd-info, Ds-kd-kk, Ds-kd-kk/s, Ds-kd-kp, Ds-kd-kp/s, Ds-kd-m, Ds-kd3003-e6, Ds-kd8003ime1(b), Ds-kd8003ime1(b)/flush, Ds-kd8003ime1(b)/ns, Ds-kd8003ime1(b)/s, Ds-kd8003ime1(b)/surface, Ds-kh6220-le1, Ds-kh6320-le1, Ds-kh6320-tde1, Ds-kh6320-te1, Ds-kh6320-wtde1, Ds-kh6320-wte1, Ds-kh6350-wte1, Ds-kh6351-te1

Showing 25 of 30 recorded product entries.

How to fix CVE-2023-6895

No vendor patch reference has been recorded for CVE-2023-6895 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.

Threat activity tracking CVE-2023-6895

2 tracked threats in the Threadlinqs corpus reference CVE-2023-6895, either in the campaign’s CVE list or as an indicator on the campaign record.

Seedworm (MuddyWater) Iranian MOIS APT Deploys Dindoor and Fakeset Backdoors Against U.S. Bank, Airport, and Defense Software Company — CRITICAL · 2026-06-10
AsyncRAT Espionage Campaign Targeting Libyan Oil Infrastructure — HIGH · 2026-03-20

Sources

Seeded from nvd and not yet processed by the Threadlinqs enrichment pipeline, so blank CVSS, EPSS or KEV fields above mean NOT MEASURED rather than measured-absent.

Full detection coverage & IOCs for threats exploiting CVE-2023-6895 are available via the Threadlinqs MCP server (Purple tier). View plans →

← all vulnerabilities · Markdown version · Threadlinqs Intelligence