CVE-2023-6895 | Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK) /php/ping.php jsondata[ip] os command injection

A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK). It has been declared as critical. This vulnerability affects unknown code of the file /php/ping.php. The manipulation of the argument jsondata[ip] with the input netstat -ano leads to os command injection.

This vulnerability was named CVE-2023-6895. Access to the local network is required for this attack to succeed. Furthermore, there is an exploit available.

The vendor was contacted early about this disclosure but did not respond in any way.