CVE-2023-6893

What it actually does

The flaw is an unauthenticated path traversal in the Hikvision Intercom Broadcasting System file download/export endpoint `/php/exportrecord.php`. The `downname` parameter is used to select a file for download without sufficiently constraining it to the intended export directory. By supplying an absolute or traversal-style path, an attacker can cause the application to return files outside the permitted directory. The demonstrated input references `C:\ICPAS\Wnmp\WWW\php\conversion.php`, indicating exposure of local application source files. The primary impact is confidentiality loss; there is no confirmed direct code execution or data modification from the described issue.

Why it matters to the business

A remote attacker can potentially read sensitive files from an exposed intercom management system, including application source code, configuration files, credentials, logs, or operational records. Compromise of these systems can affect physical security operations, building communications, and incident response workflows. The high EPSS score and public exploit availability make internet-facing deployments a priority even though the vulnerability is not currently listed in CISA KEV and is not known from the provided data to be used in ransomware campaigns. Note that the supplied affected package list appears inconsistent with the Hikvision product description; remediation should be validated against the vendor advisory and actual deployed software inventory.

How an attack unfolds

An attacker first identifies a reachable Hikvision Intercom Broadcasting System instance, typically by web fingerprinting or probing for known paths. The attacker then sends an HTTP request to `/php/exportrecord.php` with a crafted `downname` value pointing to a file outside the intended download location. If the application fails to normalize and restrict the requested path, it reads the attacker-supplied file path and returns the file contents in the HTTP response. The attacker may begin with known application files such as `C:\ICPAS\Wnmp\WWW\php\conversion.php`, then iterate through configuration files, PHP source files, web server configuration, database connection settings, logs, or other readable files. Any credentials or internal details recovered can be reused for follow-on access, lateral movement, or targeted attacks against the broader environment.

How to fix it

Upgrade Hikvision Intercom Broadcasting System to version 4.1.0 or later, which is reported to address this vulnerability. If immediate upgrade is not possible, restrict access to the management interface and `/php/exportrecord.php` to trusted administrative networks, block public internet access, require VPN or equivalent access controls, and add web server or WAF rules that deny `downname` values containing drive-letter paths, `..`, encoded traversal sequences, backslashes, or absolute paths. Review the application configuration to ensure file download logic uses an allowlist of export files and canonical path validation. The provided per-package fixed versions for Debian and Ubuntu Linux kernel packages appear unrelated to the Hikvision application; confirm applicability before treating those package upgrades as remediation for this specific issue.

How to confirm the fix worked

Confirm the deployed Hikvision Intercom Broadcasting System version is 4.1.0 or later through the product UI, vendor-supported version command, package metadata, or file manifest. From a controlled test host, verify that requests to `/php/exportrecord.php` with `downname` values containing absolute paths, encoded paths, backslashes, or traversal sequences are rejected and do not return local file contents. Review web access logs to ensure there are no successful HTTP 200 responses with large response sizes for suspicious `downname` requests. Validate that internet exposure has been removed or limited to trusted sources. If compensating WAF controls are used, test both plain and URL-encoded variants of traversal payloads.

Typical attack path

1. Discover an exposed Hikvision Intercom Broadcasting System web interface.
2. Probe for the vulnerable endpoint `/php/exportrecord.php`.
3. Send a crafted request with the `downname` parameter set to an absolute or traversal path such as `C:\ICPAS\Wnmp\WWW\php\conversion.php`.
4. Review the HTTP response for returned local file contents.
5. Iterate over additional likely paths for source code, configuration files, credentials, logs, and operational records.
6. Use recovered secrets or system information for further compromise or persistence.

How to detect it

Review HTTP access logs, reverse proxy logs, WAF logs, and endpoint telemetry from systems hosting Hikvision Intercom Broadcasting System. Focus on requests to `/php/exportrecord.php` containing the `downname` parameter with Windows drive paths, backslashes, `..`, URL-encoded traversal sequences, or references to PHP/configuration files. Investigate successful responses, especially HTTP 200 responses or unusually large downloads, as potential file disclosure. Look for repeated enumeration of file paths from a single source, requests for `conversion.php`, application configuration files, database settings, web server configuration, and logs. If available, correlate suspicious web requests with process/file access telemetry showing the web server or PHP runtime reading files outside the expected export directory. Because exploitation may only read files, host artifacts may be minimal; web logs and WAF telemetry are the highest-value sources.

• /php/exportrecord.php
• downname=
• downname=C:\\ICPAS\\Wnmp\\WWW\\php\\conversion.php
• C:\\ICPAS\\Wnmp\\WWW\\php\\conversion.php
• conversion.php
• %5cICPAS%5cWnmp%5cWWW%5cphp%5cconversion.php
• ..%2f
• ..%5c
• %2e%2e%2f
• %2e%2e%5c
• ../
• ..\\
• C:\\ICPAS\\Wnmp\\WWW\\php\\
• GET /php/exportrecord.php
• POST /php/exportrecord.php

What your security team should do

• Inventory all Hikvision Intercom Broadcasting System deployments and identify any internet-facing management interfaces.
• Prioritize upgrade to version 4.1.0 or later because exploit code is public and EPSS indicates elevated likelihood of exploitation.
• Immediately restrict external access to `/php/exportrecord.php` and the broader management interface until the upgrade is complete.
• Search historical web access logs for suspicious `downname` requests, especially references to Windows absolute paths, PHP source files, configuration files, or traversal sequences.
• If suspicious access is found, assume sensitive local files may have been disclosed and rotate credentials that could have been stored in application configuration files.
• Validate vendor advisory applicability because the supplied OS package fixed-version list is inconsistent with the Hikvision product vulnerability details.
• Add SIEM detections for traversal attempts against Hikvision PHP endpoints and alert on repeated probing from the same source IP.