What is CVE-2023-6895?
A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK). It has been declared as critical. This vulnerability affects unknown code of the file /php/ping.php. The manipulation of the argument jsondata[ip] with the input netstat -ano leads to os command injection. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.0 is able to address this issue. It is recommended to upgrade the affected component. VDB-248254 is the identifier assigned to this vulnerability.
The record classifies CVE-2023-6895 under weakness class CWE-78. Its CVSS v3 base vector states that the flaw is reachable from an adjacent network, needs no prior authentication, needs no user interaction. 30 affected-product entries are recorded, across 1 vendor, listed below. The identifier was first published 1047 days ago.
Severity and exploitation probability
- CVSS v3.1 base score
- 6.3 — MEDIUM
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - EPSS (FIRST)
- 89.1% probability of exploitation in the next 30 days, higher than 99.7% of all scored CVEs
- CISA KEV
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Threadlinqs priority
- 9.6/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
- Published
- 2023-12-17, last modified 2024-11-21
Is CVE-2023-6895 being exploited?
Weaponised exploit code for CVE-2023-6895 is publicly available. 3 public proof-of-concept repositories are tracked for this identifier. A ProjectDiscovery Nuclei detection template exists (http/cves/2023/CVE-2023-6895.yaml). It currently carries a trending score of 40 in the Threadlinqs vulnerability feed.
- FuBoLuSec/CVE-2023-6895 (github)
- nles-crt/CVE-2023-6895 (github)
- trickest/cve (trickest)
Affected products and versions
- Hikvision: Intercom Broadcast System, Ds-kd-bk, Ds-kd-dis, Ds-kd-e, Ds-kd-in, Ds-kd-info, Ds-kd-kk, Ds-kd-kk/s, Ds-kd-kp, Ds-kd-kp/s, Ds-kd-m, Ds-kd3003-e6, Ds-kd8003ime1(b), Ds-kd8003ime1(b)/flush, Ds-kd8003ime1(b)/ns, Ds-kd8003ime1(b)/s, Ds-kd8003ime1(b)/surface, Ds-kh6220-le1, Ds-kh6320-le1, Ds-kh6320-tde1, Ds-kh6320-te1, Ds-kh6320-wtde1, Ds-kh6320-wte1, Ds-kh6350-wte1, Ds-kh6351-te1
Showing 25 of 30 recorded product entries.
How to fix CVE-2023-6895
No vendor patch reference has been recorded for CVE-2023-6895 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.
Threat activity tracking CVE-2023-6895
2 tracked threats in the Threadlinqs corpus reference CVE-2023-6895, either in the campaign’s CVE list or as an indicator on the campaign record.
Sources
Enriched from CVE.org, FIRST EPSS, public proof-of-concept repositories, ProjectDiscovery Nuclei. Last verified by Threadlinqs on .