CVE-2023-6895

What it actually does

This is an unauthenticated OS command injection flaw in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK), in the /php/ping.php endpoint. The application passes the jsondata[ip] parameter into an operating-system command without sufficient validation or escaping, allowing an attacker to inject arbitrary shell commands. Because the CVSS vector is network-accessible, low-complexity, requires no privileges, and requires no user interaction, successful exploitation can provide full compromise of confidentiality, integrity, and availability of the affected appliance or server process context.

Why it matters to the business

A vulnerable intercom broadcasting system exposed to a network can be remotely taken over, disrupted, or used as a foothold into adjacent systems. Attackers may disable communications, alter broadcast behavior, steal configuration or credentials available to the application, deploy malware, or pivot further into operational networks. Public exploit details are available and the EPSS score is very high, indicating elevated real-world exploitation likelihood even though it is not currently listed in CISA KEV.

How an attack unfolds

An attacker first identifies a reachable Hikvision Intercom Broadcasting System instance running the affected 3.0.3_20201113_RELEASE(HIK) build. They then send a crafted HTTP request to /php/ping.php containing a malicious jsondata[ip] value. Instead of supplying only an IP address, the attacker injects shell syntax or direct commands; the public example uses input such as netstat -ano. If the vulnerable code concatenates this value into a system command, the operating system executes the injected command under the privileges of the web application or service account. The attacker can then enumerate the host, retrieve files, create persistence, download additional tooling, open a reverse shell, or modify service behavior. Because exploitation is weaponized and requires no authentication, internet-facing or broadly reachable deployments are high-priority targets.

How to fix it

Upgrade Hikvision Intercom Broadcasting System to version 4.1.0 or later, which is identified as the fixed version for this flaw. If immediate upgrade is not possible, restrict access to the management/application interface to trusted administrative networks only, block external access to /php/ping.php, place the system behind a VPN or access gateway, and apply web application firewall rules that reject shell metacharacters and command strings in jsondata[ip]. Validate that the endpoint accepts only well-formed IP addresses and does not invoke shell commands with unsanitized user input. Rotate credentials and review appliance integrity after patching if the system was previously exposed. The supplied package metadata also lists fixed Linux kernel package versions for Debian and Ubuntu variants; where those packages are in scope for separate platform maintenance, ensure systems meet or exceed the listed fixed versions, but the application-level Hikvision remediation is upgrade to 4.1.0 or later.

How to confirm the fix worked

Confirm the installed Hikvision Intercom Broadcasting System version is 4.1.0 or later. Verify that /php/ping.php is not reachable from untrusted networks. Perform a safe validation test by sending benign malformed jsondata[ip] values containing shell metacharacters such as semicolon, pipe, backticks, or $() and confirm the application rejects them without executing commands or returning command output. Review web server logs to ensure requests to /php/ping.php no longer produce operating-system command output. On Linux hosts, confirm no child shell processes are spawned by the web server or PHP runtime during use of the ping function. If compensating controls are used, test that network ACLs, reverse proxy rules, or WAF signatures block requests containing suspicious jsondata[ip] payloads.

Typical attack path

1. Discover a Hikvision Intercom Broadcasting System web interface reachable over HTTP or HTTPS.
2. Fingerprint the version or test for the presence of /php/ping.php.
3. Send a crafted request to /php/ping.php with a malicious jsondata[ip] parameter containing an injected operating-system command.
4. Confirm command execution using low-impact commands such as id, whoami, uname, netstat, or ping/curl callbacks.
5. Execute follow-on commands to enumerate the host, users, network interfaces, routes, and running services.
6. Download or stage additional payloads using curl, wget, tftp, busybox, or similar tools if available.
7. Establish persistence, create a backdoor account or shell, alter application files, or pivot to other reachable systems.

How to detect it

Check web server, reverse proxy, WAF, and application logs for requests to /php/ping.php, especially POST requests or query/body parameters containing jsondata[ip]. Look for command injection syntax in that parameter, including semicolons, pipes, ampersands, backticks, $(), newline encodings, URL-encoded separators, or commands such as netstat, id, whoami, uname, wget, curl, chmod, nc, bash, sh, busybox, tftp, or python. Correlate suspicious requests with host telemetry showing the web server, PHP runtime, or application service spawning shell processes or networking/download utilities. Examine filesystem changes in temporary and web-accessible directories, new or modified PHP files, unexpected cron entries, new users or SSH keys, and outbound connections shortly after suspicious HTTP requests. If EDR is available, hunt for process trees where httpd, apache2, nginx, php-fpm, or php-cgi launches /bin/sh, /bin/bash, netstat, curl, wget, nc, or chmod. Network monitoring should look for callbacks to unfamiliar external IPs immediately after exploitation attempts.

• /php/ping.php
• jsondata[ip]
• jsondata%5Bip%5D
• netstat -ano
• /php/ping.php?jsondata
• POST /php/ping.php
• GET /php/ping.php
• jsondata[ip]=netstat
• jsondata%5Bip%5D=netstat
• jsondata[ip]=whoami
• jsondata[ip]=id
• jsondata[ip]=uname
• jsondata[ip]=;
• jsondata[ip]=|
• jsondata[ip]=`
• jsondata[ip]=$(
• %3Bnetstat
• %7Cnetstat
• %60netstat
• %24%28
• /bin/sh -c
• /bin/bash -c
• php-fpm -> /bin/sh
• php-cgi -> /bin/sh
• apache2 -> /bin/sh
• httpd -> /bin/sh
• nginx -> /bin/sh
• wget http
• curl http
• busybox wget
• chmod +x /tmp
• /tmp/.
• nc -e
• ncat -e
• bash -i
• /dev/tcp/

What your security team should do

• Prioritize upgrade of Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK) to 4.1.0 or later, especially for internet-facing or cross-network reachable systems.
• Immediately restrict inbound access to the application and /php/ping.php to trusted administrative sources until patching is complete.
• Hunt historical logs for requests to /php/ping.php containing jsondata[ip] values with command separators, shell substitutions, or known reconnaissance commands.
• Review process execution telemetry for web server or PHP parent processes spawning shells, network tools, file download utilities, or system administration commands.
• Assume exposed vulnerable systems may have been probed due to public exploit availability and high EPSS; perform credential rotation and integrity review if suspicious activity is found.
• Add SIEM/WAF detections for command injection patterns targeting jsondata[ip] and alert on any access to /php/ping.php from untrusted sources.
• If the appliance resides in an operational technology or physical security network, verify segmentation prevents lateral movement to critical systems.