CVE-2023-6893
Hikvision Intercom Broadcasting System exportrecord.php path traversal
Severity Score
7.5
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
1
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK) and classified as problematic. Affected by this issue is some unknown functionality of the file /php/exportrecord.php. The manipulation of the argument downname with the input C:\ICPAS\Wnmp\WWW\php\conversion.php leads to path traversal. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-248252.
Una vulnerabilidad fue encontrada en Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK) y clasificada como problemática. Una función desconocida del archivo /php/exportrecord.php es afectada por esta vulnerabilidad. La manipulación del argumento downname con la entrada C:\ICPAS\Wnmp\WWW\php\conversion.php conduce a un path traversal. El exploit ha sido divulgado al público y puede utilizarse. El identificador de esta vulnerabilidad es VDB-248252. NOTA: Se contactó primeramente con el proveedor sobre esta divulgación, pero no respondió de ninguna manera.
Eine Schwachstelle wurde in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK) gefunden. Sie wurde als problematisch eingestuft. Dies betrifft einen unbekannten Teil der Datei /php/exportrecord.php. Durch Manipulation des Arguments downname mit der Eingabe C:\ICPAS\Wnmp\WWW\php\conversion.php mit unbekannten Daten kann eine path traversal-Schwachstelle ausgenutzt werden. Der Exploit steht zur öffentlichen Verfügung. Ein Aktualisieren auf die Version 4.1.0 vermag dieses Problem zu lösen. Als bestmögliche Massnahme wird das Einspielen eines Upgrades empfohlen.
*Credits:
willchen, willchen
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2023-12-16 CVE Reserved
- 2023-12-17 CVE Published
- 2024-08-02 CVE Updated
- 2024-08-02 First Exploit
- 2025-01-18 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| https://vuldb.com/?id.248252 | Technical Description |
| URL | Date | SRC |
|---|---|---|
| https://github.com/willchen0011/cve/blob/main/download.md | 2024-08-02 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Hikvision Search vendor "Hikvision" | Intercom Broadcast System Search vendor "Hikvision" for product "Intercom Broadcast System" | >= 3.0.3 < 4.1.0 Search vendor "Hikvision" for product "Intercom Broadcast System" and version " >= 3.0.3 < 4.1.0" | - |
Affected
| in | Hikvision Search vendor "Hikvision" | Ds-kd-bk Search vendor "Hikvision" for product "Ds-kd-bk" | - | - |
Safe
|
| Hikvision Search vendor "Hikvision" | Intercom Broadcast System Search vendor "Hikvision" for product "Intercom Broadcast System" | >= 3.0.3 < 4.1.0 Search vendor "Hikvision" for product "Intercom Broadcast System" and version " >= 3.0.3 < 4.1.0" | - |
Affected
| in | Hikvision Search vendor "Hikvision" | Ds-kd-dis Search vendor "Hikvision" for product "Ds-kd-dis" | - | - |
Safe
|
| Hikvision Search vendor "Hikvision" | Intercom Broadcast System Search vendor "Hikvision" for product "Intercom Broadcast System" | >= 3.0.3 < 4.1.0 Search vendor "Hikvision" for product "Intercom Broadcast System" and version " >= 3.0.3 < 4.1.0" | - |
Affected
| in | Hikvision Search vendor "Hikvision" | Ds-kd-e Search vendor "Hikvision" for product "Ds-kd-e" | - | - |
Safe
|
| Hikvision Search vendor "Hikvision" | Intercom Broadcast System Search vendor "Hikvision" for product "Intercom Broadcast System" | >= 3.0.3 < 4.1.0 Search vendor "Hikvision" for product "Intercom Broadcast System" and version " >= 3.0.3 < 4.1.0" | - |
Affected
| in | Hikvision Search vendor "Hikvision" | Ds-kd-in Search vendor "Hikvision" for product "Ds-kd-in" | - | - |
Safe
|
| Hikvision Search vendor "Hikvision" | Intercom Broadcast System Search vendor "Hikvision" for product "Intercom Broadcast System" | >= 3.0.3 < 4.1.0 Search vendor "Hikvision" for product "Intercom Broadcast System" and version " >= 3.0.3 < 4.1.0" | - |
Affected
| in | Hikvision Search vendor "Hikvision" | Ds-kd-info Search vendor "Hikvision" for product "Ds-kd-info" | - | - |
Safe
|
| Hikvision Search vendor "Hikvision" | Intercom Broadcast System Search vendor "Hikvision" for product "Intercom Broadcast System" | >= 3.0.3 < 4.1.0 Search vendor "Hikvision" for product "Intercom Broadcast System" and version " >= 3.0.3 < 4.1.0" | - |
Affected
| in | Hikvision Search vendor "Hikvision" | Ds-kd-kk Search vendor "Hikvision" for product "Ds-kd-kk" | - | - |
Safe
|
| Hikvision Search vendor "Hikvision" | Intercom Broadcast System Search vendor "Hikvision" for product "Intercom Broadcast System" | >= 3.0.3 < 4.1.0 Search vendor "Hikvision" for product "Intercom Broadcast System" and version " >= 3.0.3 < 4.1.0" | - |
Affected
| in | Hikvision Search vendor "Hikvision" | Ds-kd-kk\/s Search vendor "Hikvision" for product "Ds-kd-kk\/s" | - | - |
Safe
|
| Hikvision Search vendor "Hikvision" | Intercom Broadcast System Search vendor "Hikvision" for product "Intercom Broadcast System" | >= 3.0.3 < 4.1.0 Search vendor "Hikvision" for product "Intercom Broadcast System" and version " >= 3.0.3 < 4.1.0" | - |
Affected
| in | Hikvision Search vendor "Hikvision" | Ds-kd-kp Search vendor "Hikvision" for product "Ds-kd-kp" | - | - |
Safe
|
| Hikvision Search vendor "Hikvision" | Intercom Broadcast System Search vendor "Hikvision" for product "Intercom Broadcast System" | >= 3.0.3 < 4.1.0 Search vendor "Hikvision" for product "Intercom Broadcast System" and version " >= 3.0.3 < 4.1.0" | - |
Affected
| in | Hikvision Search vendor "Hikvision" | Ds-kd-kp\/s Search vendor "Hikvision" for product "Ds-kd-kp\/s" | - | - |
Safe
|
| Hikvision Search vendor "Hikvision" | Intercom Broadcast System Search vendor "Hikvision" for product "Intercom Broadcast System" | >= 3.0.3 < 4.1.0 Search vendor "Hikvision" for product "Intercom Broadcast System" and version " >= 3.0.3 < 4.1.0" | - |
Affected
| in | Hikvision Search vendor "Hikvision" | Ds-kd-m Search vendor "Hikvision" for product "Ds-kd-m" | - | - |
Safe
|
| Hikvision Search vendor "Hikvision" | Intercom Broadcast System Search vendor "Hikvision" for product "Intercom Broadcast System" | >= 3.0.3 < 4.1.0 Search vendor "Hikvision" for product "Intercom Broadcast System" and version " >= 3.0.3 < 4.1.0" | - |
Affected
| in | Hikvision Search vendor "Hikvision" | Ds-kd3003-e6 Search vendor "Hikvision" for product "Ds-kd3003-e6" | - | - |
Safe
|
| Hikvision Search vendor "Hikvision" | Intercom Broadcast System Search vendor "Hikvision" for product "Intercom Broadcast System" | >= 3.0.3 < 4.1.0 Search vendor "Hikvision" for product "Intercom Broadcast System" and version " >= 3.0.3 < 4.1.0" | - |
Affected
| in | Hikvision Search vendor "Hikvision" | Ds-kd8003ime1\(b\) Search vendor "Hikvision" for product "Ds-kd8003ime1\(b\)" | - | - |
Safe
|
| Hikvision Search vendor "Hikvision" | Intercom Broadcast System Search vendor "Hikvision" for product "Intercom Broadcast System" | >= 3.0.3 < 4.1.0 Search vendor "Hikvision" for product "Intercom Broadcast System" and version " >= 3.0.3 < 4.1.0" | - |
Affected
| in | Hikvision Search vendor "Hikvision" | Ds-kd8003ime1\(b\)\/flush Search vendor "Hikvision" for product "Ds-kd8003ime1\(b\)\/flush" | - | - |
Safe
|
| Hikvision Search vendor "Hikvision" | Intercom Broadcast System Search vendor "Hikvision" for product "Intercom Broadcast System" | >= 3.0.3 < 4.1.0 Search vendor "Hikvision" for product "Intercom Broadcast System" and version " >= 3.0.3 < 4.1.0" | - |
Affected
| in | Hikvision Search vendor "Hikvision" | Ds-kd8003ime1\(b\)\/ns Search vendor "Hikvision" for product "Ds-kd8003ime1\(b\)\/ns" | - | - |
Safe
|
| Hikvision Search vendor "Hikvision" | Intercom Broadcast System Search vendor "Hikvision" for product "Intercom Broadcast System" | >= 3.0.3 < 4.1.0 Search vendor "Hikvision" for product "Intercom Broadcast System" and version " >= 3.0.3 < 4.1.0" | - |
Affected
| in | Hikvision Search vendor "Hikvision" | Ds-kd8003ime1\(b\)\/s Search vendor "Hikvision" for product "Ds-kd8003ime1\(b\)\/s" | - | - |
Safe
|
| Hikvision Search vendor "Hikvision" | Intercom Broadcast System Search vendor "Hikvision" for product "Intercom Broadcast System" | >= 3.0.3 < 4.1.0 Search vendor "Hikvision" for product "Intercom Broadcast System" and version " >= 3.0.3 < 4.1.0" | - |
Affected
| in | Hikvision Search vendor "Hikvision" | Ds-kd8003ime1\(b\)\/surface Search vendor "Hikvision" for product "Ds-kd8003ime1\(b\)\/surface" | - | - |
Safe
|
| Hikvision Search vendor "Hikvision" | Intercom Broadcast System Search vendor "Hikvision" for product "Intercom Broadcast System" | >= 3.0.3 < 4.1.0 Search vendor "Hikvision" for product "Intercom Broadcast System" and version " >= 3.0.3 < 4.1.0" | - |
Affected
| in | Hikvision Search vendor "Hikvision" | Ds-kh6220-le1 Search vendor "Hikvision" for product "Ds-kh6220-le1" | - | - |
Safe
|
| Hikvision Search vendor "Hikvision" | Intercom Broadcast System Search vendor "Hikvision" for product "Intercom Broadcast System" | >= 3.0.3 < 4.1.0 Search vendor "Hikvision" for product "Intercom Broadcast System" and version " >= 3.0.3 < 4.1.0" | - |
Affected
| in | Hikvision Search vendor "Hikvision" | Ds-kh6320-le1 Search vendor "Hikvision" for product "Ds-kh6320-le1" | - | - |
Safe
|
| Hikvision Search vendor "Hikvision" | Intercom Broadcast System Search vendor "Hikvision" for product "Intercom Broadcast System" | >= 3.0.3 < 4.1.0 Search vendor "Hikvision" for product "Intercom Broadcast System" and version " >= 3.0.3 < 4.1.0" | - |
Affected
| in | Hikvision Search vendor "Hikvision" | Ds-kh6320-tde1 Search vendor "Hikvision" for product "Ds-kh6320-tde1" | - | - |
Safe
|
| Hikvision Search vendor "Hikvision" | Intercom Broadcast System Search vendor "Hikvision" for product "Intercom Broadcast System" | >= 3.0.3 < 4.1.0 Search vendor "Hikvision" for product "Intercom Broadcast System" and version " >= 3.0.3 < 4.1.0" | - |
Affected
| in | Hikvision Search vendor "Hikvision" | Ds-kh6320-te1 Search vendor "Hikvision" for product "Ds-kh6320-te1" | - | - |
Safe
|
| Hikvision Search vendor "Hikvision" | Intercom Broadcast System Search vendor "Hikvision" for product "Intercom Broadcast System" | >= 3.0.3 < 4.1.0 Search vendor "Hikvision" for product "Intercom Broadcast System" and version " >= 3.0.3 < 4.1.0" | - |
Affected
| in | Hikvision Search vendor "Hikvision" | Ds-kh6320-wtde1 Search vendor "Hikvision" for product "Ds-kh6320-wtde1" | - | - |
Safe
|
| Hikvision Search vendor "Hikvision" | Intercom Broadcast System Search vendor "Hikvision" for product "Intercom Broadcast System" | >= 3.0.3 < 4.1.0 Search vendor "Hikvision" for product "Intercom Broadcast System" and version " >= 3.0.3 < 4.1.0" | - |
Affected
| in | Hikvision Search vendor "Hikvision" | Ds-kh6320-wte1 Search vendor "Hikvision" for product "Ds-kh6320-wte1" | - | - |
Safe
|
| Hikvision Search vendor "Hikvision" | Intercom Broadcast System Search vendor "Hikvision" for product "Intercom Broadcast System" | >= 3.0.3 < 4.1.0 Search vendor "Hikvision" for product "Intercom Broadcast System" and version " >= 3.0.3 < 4.1.0" | - |
Affected
| in | Hikvision Search vendor "Hikvision" | Ds-kh6350-wte1 Search vendor "Hikvision" for product "Ds-kh6350-wte1" | - | - |
Safe
|
| Hikvision Search vendor "Hikvision" | Intercom Broadcast System Search vendor "Hikvision" for product "Intercom Broadcast System" | >= 3.0.3 < 4.1.0 Search vendor "Hikvision" for product "Intercom Broadcast System" and version " >= 3.0.3 < 4.1.0" | - |
Affected
| in | Hikvision Search vendor "Hikvision" | Ds-kh6351-te1 Search vendor "Hikvision" for product "Ds-kh6351-te1" | - | - |
Safe
|
| Hikvision Search vendor "Hikvision" | Intercom Broadcast System Search vendor "Hikvision" for product "Intercom Broadcast System" | >= 3.0.3 < 4.1.0 Search vendor "Hikvision" for product "Intercom Broadcast System" and version " >= 3.0.3 < 4.1.0" | - |
Affected
| in | Hikvision Search vendor "Hikvision" | Ds-kh6351-wte1 Search vendor "Hikvision" for product "Ds-kh6351-wte1" | - | - |
Safe
|
| Hikvision Search vendor "Hikvision" | Intercom Broadcast System Search vendor "Hikvision" for product "Intercom Broadcast System" | >= 3.0.3 < 4.1.0 Search vendor "Hikvision" for product "Intercom Broadcast System" and version " >= 3.0.3 < 4.1.0" | - |
Affected
| in | Hikvision Search vendor "Hikvision" | Ds-kh63le1\(b\) Search vendor "Hikvision" for product "Ds-kh63le1\(b\)" | - | - |
Safe
|
| Hikvision Search vendor "Hikvision" | Intercom Broadcast System Search vendor "Hikvision" for product "Intercom Broadcast System" | >= 3.0.3 < 4.1.0 Search vendor "Hikvision" for product "Intercom Broadcast System" and version " >= 3.0.3 < 4.1.0" | - |
Affected
| in | Hikvision Search vendor "Hikvision" | Ds-kh8520-wte1 Search vendor "Hikvision" for product "Ds-kh8520-wte1" | - | - |
Safe
|
| Hikvision Search vendor "Hikvision" | Intercom Broadcast System Search vendor "Hikvision" for product "Intercom Broadcast System" | >= 3.0.3 < 4.1.0 Search vendor "Hikvision" for product "Intercom Broadcast System" and version " >= 3.0.3 < 4.1.0" | - |
Affected
| in | Hikvision Search vendor "Hikvision" | Ds-kh9310-wte1\(b\) Search vendor "Hikvision" for product "Ds-kh9310-wte1\(b\)" | - | - |
Safe
|
| Hikvision Search vendor "Hikvision" | Intercom Broadcast System Search vendor "Hikvision" for product "Intercom Broadcast System" | >= 3.0.3 < 4.1.0 Search vendor "Hikvision" for product "Intercom Broadcast System" and version " >= 3.0.3 < 4.1.0" | - |
Affected
| in | Hikvision Search vendor "Hikvision" | Ds-kh9510-wte1\(b\) Search vendor "Hikvision" for product "Ds-kh9510-wte1\(b\)" | - | - |
Safe
|