PT-2023-4123 · Zkteco · Zkteco Biotime

CVE-2023-38949 · Publicado 2023-08-01 · Atualizado 2025-05-03

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions ZKTeco BioTime version 8.5.5

Description The issue is related to a hidden API in the ZKTeco BioTime platform, which allows unauthenticated attackers to reset the Administrator password via a crafted web request. This can be exploited by a remote attacker, potentially leading to unauthorized access. The vulnerability is associated with the use of dangerous methods or functions in the web platform's interface.

Recommendations For ZKTeco BioTime version 8.5.5, consider restricting access to the hidden API endpoint until a patch is available. As a temporary workaround, limit the ability to reset the Administrator password to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-749

Identificadores relacionados

BDU:2023-04432

CVE-2023-38949

Produtos afetados

Zkteco Biotime

Referências · 7

• https://osv.dev/vulnerability/CVE-2023-38949 · Aviso do Fabricante
• https://claroty.com/team82/disclosure-dashboard/cve-2023-38949 · Nota
• https://t.me/cvenotify/55764 · Publicação no Telegram
• http://zkteco.com · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-38949 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-04432 · Nota de Segurança
• https://twitter.com/gothburz/status/1918682593198784888 · Publicação no Twitter