CVE-2023-6893
Published: 17 December 2023
Summary
CVE-2023-6893 is a medium-severity Path Traversal (CWE-22) vulnerability in Hikvision Intercom Broadcast System. Its CVSS base score is 4.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Direct Volume Access (T1006); ranked in the top 0.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A path traversal vulnerability exists in Hikvision Intercom Broadcasting System version 3.0.3_20201113_RELEASE(HIK). The flaw resides in the /php/exportrecord.php file, where the downname parameter can be manipulated to traverse directories, as demonstrated by supplying an absolute path such as C:\ICPAS\Wnmp\WWW\php\conversion.php. The issue is tracked as CWE-22 and carries a CVSS 3.1 score of 4.3.
An attacker on an adjacent network can exploit the vulnerability without authentication or user interaction to read arbitrary files on the affected system. Public proof-of-concept code has been released, enabling straightforward reproduction of the traversal.
The vendor states that upgrading to version 4.1.0 resolves the weakness. Security advisories recommend applying this update to the intercom broadcasting component as the primary mitigation.
The associated EPSS score stands at 0.8841.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-59094
Vulnerability details
A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK) and classified as problematic. Affected by this issue is some unknown functionality of the file /php/exportrecord.php. The manipulation of the argument downname with the input C:\ICPAS\Wnmp\WWW\php\conversion.php leads to path traversal.…
more
The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-248252.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal in /php/exportrecord.php enables direct reading of arbitrary local files (T1006: Direct Volume Access). Vulnerability in public-facing web application facilitates remote exploitation (T1190: Exploit Public-Facing Application).
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.