CVSS: 9.8EPSS: 92%CPEs: 30EXPL: 3CVE-2023-6895 – Hikvision Intercom Broadcasting System ping.php os command injection
https://notcve.org/view.php?id=CVE-2023-6895
17 Dec 2023 — A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK). It has been declared as critical. This vulnerability affects unknown code of the file /php/ping.php. The manipulation of the argument jsondata[ip] with the input netstat -ano leads to os command injection. The exploit has been disclosed to the public and may be used. • https://github.com/FuBoLuSec/CVE-2023-6895 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 6.5EPSS: 0%CPEs: 30EXPL: 1CVE-2023-6894 – Hikvision Intercom Broadcasting System Log File system.html information disclosure
https://notcve.org/view.php?id=CVE-2023-6894
17 Dec 2023 — A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK). It has been classified as problematic. This affects an unknown part of the file access/html/system.html of the component Log File Handler. The manipulation leads to information disclosure. The exploit has been disclosed to the public and may be used. • https://github.com/willchen0011/cve/blob/main/unaccess.md • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.5EPSS: 0%CPEs: 30EXPL: 1CVE-2023-6893 – Hikvision Intercom Broadcasting System exportrecord.php path traversal
https://notcve.org/view.php?id=CVE-2023-6893
17 Dec 2023 — A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK) and classified as problematic. Affected by this issue is some unknown functionality of the file /php/exportrecord.php. The manipulation of the argument downname with the input C:\ICPAS\Wnmp\WWW\php\conversion.php leads to path traversal. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.0 is able to address this issue. • https://github.com/willchen0011/cve/blob/main/download.md • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •