A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK). It has been declared as critical. This vulnerability affects unknown code of the file /php/ping.php. The manipulation of the argument jsondata[ip] with the input netstat -ano leads to os command injection. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.0 is able to address this issue. It is recommended to upgrade the affected component. VDB-248254 is the identifier assigned to this vulnerability.
References
| Link | Resource |
|---|---|
| https://github.com/willchen0011/cve/blob/main/rce.md | Exploit Third Party Advisory |
| https://vuldb.com/?ctiid.248254 | Permissions Required Third Party Advisory |
| https://vuldb.com/?id.248254 | Third Party Advisory |
| https://github.com/willchen0011/cve/blob/main/rce.md | Exploit Third Party Advisory |
| https://vuldb.com/?ctiid.248254 | Permissions Required Third Party Advisory |
| https://vuldb.com/?id.248254 | Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Nov 2024, 08:44
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 5.8
v3 : 6.3 |
| References | () https://github.com/willchen0011/cve/blob/main/rce.md - Exploit, Third Party Advisory | |
| References | () https://vuldb.com/?ctiid.248254 - Permissions Required, Third Party Advisory | |
| References | () https://vuldb.com/?id.248254 - Third Party Advisory |
02 Jan 2024, 13:12
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:h:hikvision:ds-kd3003-e6:-:*:*:*:*:*:*:* cpe:2.3:h:hikvision:ds-kh6351-te1:-:*:*:*:*:*:*:* cpe:2.3:h:hikvision:ds-kd-m:-:*:*:*:*:*:*:* cpe:2.3:h:hikvision:ds-kh6320-wte1:-:*:*:*:*:*:*:* cpe:2.3:h:hikvision:ds-kd-kp:-:*:*:*:*:*:*:* cpe:2.3:h:hikvision:ds-kd8003ime1\(b\)\/ns:-:*:*:*:*:*:*:* cpe:2.3:h:hikvision:ds-kh6320-wtde1:-:*:*:*:*:*:*:* cpe:2.3:h:hikvision:ds-kd-dis:-:*:*:*:*:*:*:* cpe:2.3:h:hikvision:ds-kh8520-wte1:-:*:*:*:*:*:*:* cpe:2.3:h:hikvision:ds-kd-kk\/s:-:*:*:*:*:*:*:* cpe:2.3:h:hikvision:ds-kd-kk:-:*:*:*:*:*:*:* cpe:2.3:h:hikvision:ds-kh63le1\(b\):-:*:*:*:*:*:*:* cpe:2.3:h:hikvision:ds-kd8003ime1\(b\)\/s:-:*:*:*:*:*:*:* cpe:2.3:h:hikvision:ds-kd8003ime1\(b\)\/surface:-:*:*:*:*:*:*:* cpe:2.3:h:hikvision:ds-kd-e:-:*:*:*:*:*:*:* cpe:2.3:h:hikvision:ds-kd-in:-:*:*:*:*:*:*:* cpe:2.3:h:hikvision:ds-kd8003ime1\(b\):-:*:*:*:*:*:*:* cpe:2.3:h:hikvision:ds-kh6351-wte1:-:*:*:*:*:*:*:* cpe:2.3:h:hikvision:ds-kd-info:-:*:*:*:*:*:*:* cpe:2.3:h:hikvision:ds-kh9510-wte1\(b\):-:*:*:*:*:*:*:* cpe:2.3:h:hikvision:ds-kd8003ime1\(b\)\/flush:-:*:*:*:*:*:*:* cpe:2.3:h:hikvision:ds-kh6320-le1:-:*:*:*:*:*:*:* cpe:2.3:h:hikvision:ds-kh6350-wte1:-:*:*:*:*:*:*:* cpe:2.3:h:hikvision:ds-kh6220-le1:-:*:*:*:*:*:*:* cpe:2.3:h:hikvision:ds-kh6320-te1:-:*:*:*:*:*:*:* cpe:2.3:h:hikvision:ds-kh6320-tde1:-:*:*:*:*:*:*:* cpe:2.3:h:hikvision:ds-kh9310-wte1\(b\):-:*:*:*:*:*:*:* cpe:2.3:o:hikvision:intercom_broadcast_system:*:*:*:*:*:*:*:* cpe:2.3:h:hikvision:ds-kd-kp\/s:-:*:*:*:*:*:*:* cpe:2.3:h:hikvision:ds-kd-bk:-:*:*:*:*:*:*:* |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| References | () https://vuldb.com/?ctiid.248254 - Permissions Required, Third Party Advisory | |
| References | () https://vuldb.com/?id.248254 - Third Party Advisory | |
| References | () https://github.com/willchen0011/cve/blob/main/rce.md - Exploit, Third Party Advisory | |
| First Time |
Hikvision ds-kd-kk\/s
Hikvision ds-kd-kp\/s Hikvision ds-kh6320-te1 Hikvision ds-kh6320-wte1 Hikvision ds-kd8003ime1\(b\)\/ns Hikvision ds-kh9510-wte1\(b\) Hikvision ds-kh6320-tde1 Hikvision ds-kh6220-le1 Hikvision intercom Broadcast System Hikvision ds-kd-in Hikvision ds-kd-e Hikvision ds-kd3003-e6 Hikvision ds-kh6351-wte1 Hikvision ds-kh9310-wte1\(b\) Hikvision ds-kd-dis Hikvision ds-kh6351-te1 Hikvision ds-kh63le1\(b\) Hikvision ds-kd-info Hikvision ds-kh6320-le1 Hikvision ds-kh8520-wte1 Hikvision Hikvision ds-kd-kp Hikvision ds-kd-bk Hikvision ds-kh6350-wte1 Hikvision ds-kd8003ime1\(b\)\/s Hikvision ds-kd-kk Hikvision ds-kh6320-wtde1 Hikvision ds-kd8003ime1\(b\)\/flush Hikvision ds-kd8003ime1\(b\)\/surface Hikvision ds-kd8003ime1\(b\) Hikvision ds-kd-m |
18 Dec 2023, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-12-17 08:15
Updated : 2024-11-21 08:44
NVD link : CVE-2023-6895
Mitre link : CVE-2023-6895
CVE.ORG link : CVE-2023-6895
JSON object : View
Products Affected
hikvision
- ds-kd3003-e6
- ds-kh6351-te1
- ds-kh9510-wte1\(b\)
- ds-kd-m
- ds-kh6350-wte1
- ds-kd-kk
- ds-kd-kp\/s
- ds-kd-bk
- ds-kd-dis
- ds-kh6320-wtde1
- ds-kd-kp
- ds-kd8003ime1\(b\)\/ns
- ds-kd-kk\/s
- ds-kh6320-wte1
- ds-kh8520-wte1
- ds-kd8003ime1\(b\)\/flush
- ds-kh63le1\(b\)
- ds-kh6320-te1
- ds-kh9310-wte1\(b\)
- intercom_broadcast_system
- ds-kd8003ime1\(b\)\/s
- ds-kd8003ime1\(b\)
- ds-kd-info
- ds-kd-e
- ds-kh6320-tde1
- ds-kd-in
- ds-kd8003ime1\(b\)\/surface
- ds-kh6320-le1
- ds-kh6351-wte1
- ds-kh6220-le1
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')