This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: Critical OS Command Injection in Hikvision Intercom Broadcasting System.β¦
π‘οΈ **CWE**: CWE-78 (OS Command Injection). π **Flaw**: The `/php/ping.php` endpoint fails to sanitize the `jsondata[ip]` parameter. Malicious input is passed directly to the OS shell.
Q3Who is affected? (Versions/Components)
π’ **Vendor**: Hikvision (China). π¦ **Product**: Intercom Broadcasting System. π **Affected Version**: Specifically **3.0.3_20201113_RELEASE(HIK)**. β οΈ Check if your deployment matches this exact release.
Q4What can hackers do? (Privileges/Data)
π **Privileges**: System-level access (Root/Admin equivalent). πΎ **Data**: Full read/write access to the server. π **Impact**: Can pivot to internal networks, install backdoors, or destroy system integrity.
Q5Is exploitation threshold high? (Auth/Config)
π **Auth**: No authentication required (PR:N). π **Network**: Accessible via Adjacent Network (AV:A). π **Threshold**: LOW. Simple HTTP request with crafted JSON payload triggers the exploit.
Q6Is there a public Exp? (PoC/Wild Exploitation)
π₯ **Public Exp**: YES. Active PoCs exist on GitHub (e.g., FuBoLuSec, nles-crt). π‘ **Wild Exploitation**: High risk. Automated scanners (Nuclei) already have templates. Immediate threat to exposed devices.
Q7How to self-check? (Features/Scanning)
π **Self-Check**: Use Python scripts targeting `/php/ping.php` with `jsondata[ip]` containing commands like `netstat -ano`.β¦
π οΈ **Official Fix**: YES. Upgrade to version **4.1.0** or later. π **Status**: Vendor has acknowledged the issue (VDB-248254) and released a patch. Prioritize this update.
Q9What if no patch? (Workaround)
π§ **No Patch?**: 1. Block external access to `/php/ping.php` via WAF/Firewall. 2. Restrict network access to the Intercom System LAN only. 3. Monitor logs for unusual ping requests.
Q10Is it urgent? (Priority Suggestion)
π¨ **Urgency**: CRITICAL. CVSS Score indicates High Impact. With public exploits and no auth required, immediate patching or isolation is mandatory. Do not delay!