{"id":"CVE-2023-6893","published":"2023-12-17T06:31:03Z","modified":"2024-08-02T08:42:08Z","title":"Hikvision Intercom Broadcasting System exportrecord.php path traversal","vendor":"Hikvision","product":"Intercom Broadcasting System","tier":"core","eol":null,"affectedVersions":[{"vendor":"Hikvision","product":"Intercom Broadcasting System","versions":["3.0.3_20201113_RELEASE(HIK)"]}],"description":{"text":"A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK) and classified as problematic. Affected by this issue is some unknown functionality of the file /php/exportrecord.php. The manipulation of the argument downname with the input C:\\ICPAS\\Wnmp\\WWW\\php\\conversion.php leads to path traversal. The exploit has been disclosed to the public and may be used. Upgrading to version 4.1.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-248252.","provenance":"source","from":"CVE.org"},"summary":{"text":"A path traversal flaw exists in the exportrecord.php file of the Hikvision Intercom Broadcasting System, where the downname argument is not properly restricted and can be manipulated to reach files outside the intended directory. An attacker with adjacent network access and no authentication requirement can exploit it without any user interaction, though the impact on confidentiality is limited and the flaw does not affect integrity or availability.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:13:43Z"},"cvss":{"score":4.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.70224,"percentile":0.99379,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://vuldb.com/?id.248252","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/?ctiid.248252","tags":["signature","permissions-required"]},{"url":"https://github.com/willchen0011/cve/blob/main/download.md","tags":["exploit"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2023-59094","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-59094","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":["https://github.com/willchen0011/cve/blob/main/download.md"],"flow":[],"timeline":[{"date":"2023-12-17","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2023-6893","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":27.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.88,"detail":"percentile 0.9938"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":3.01,"detail":"base score 4.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}