CVE-2023-6893 | Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK) /php/exportrecord.php downname path traversal

A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK) and classified as problematic. Affected by this issue is some unknown functionality of the file /php/exportrecord.php. The manipulation of the argument downname with the input C:ICPASWnmpWWWphpconversion.php leads to path traversal.

This vulnerability is handled as CVE-2023-6893. The attack needs to be initiated within the local network. Furthermore, there is an exploit available.

The vendor was contacted early about this disclosure but did not respond in any way.