Intercom Broadcasting System - RCE (CVE-2023-6895)

CVE-2023-6895 is a critical vulnerability in the Hikvision Intercom Broadcasting System that allows remote attackers to perform OS command injection via the /php/ping.php endpoint by manipulating the jsondata[ip] parameter. This flaw could enable attackers to execute arbitrary system commands, potentially compromising the integrity, confidentiality, and availability of the affected system. Public exploit code is available, making unpatched systems particularly vulnerable to remote code execution attacks. Upgrading to version 4.1.0 is strongly recommended to mitigate this risk.

CrowdSec has been tracking this vulnerability and its exploits since 9th of March 2026.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2023-6895 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2023-6895 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2023-6895 is currently experiencing high visibility and active exploitation across the internet.

Attackers exploit the /php/ping.php endpoint by sending crafted POST requests with malicious input in the jsondata[ip] parameter, enabling unauthenticated remote command execution on vulnerable Hikvision Intercom Broadcasting System devices.