PT-2023-29736 · Zkteco · Zkteco Zem800

David Utón Amaya · Published 2023-09-04 · Updated 2024-08-02 · CVE-2023-4587

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions ZKTeco ZEM800 version 6.60

Description An IDOR vulnerability has been found in the ZKTeco ZEM800 product. This vulnerability allows a local attacker to obtain registered user backup files or device configuration files over a local network or through a VPN server.

Recommendations For version 6.60, consider restricting access to the device configuration files and registered user backup files to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the access to the local network and VPN server to reduce the attack surface. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2023-4587

Affected Products

Zkteco Zem800

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-4587 · Security Note
• https://osv.dev/vulnerability/CVE-2023-4587 · Vendor Advisory
• https://twitter.com/cracbot/status/1698939082641121326 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1698705350860394556 · Twitter Post
• https://t.me/cibsecurity/69782 · Telegram Post
• https://twitter.com/CVEnew/status/1698661792397074554 · Twitter Post
• https://incibe.es/en/incibe-cert/notices/aviso/insecure-direct-object-reference-zkteco-zem800 · Note
• https://t.me/cvenotify/88468 · Telegram Post