PT-2023-4123 · Zkteco · Zkteco Biotime

Published 2023-08-01 · Updated 2025-05-03 · CVE-2023-38949

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions ZKTeco BioTime version 8.5.5

Description The issue is related to a hidden API in the ZKTeco BioTime platform, which allows unauthenticated attackers to reset the Administrator password via a crafted web request. This can be exploited by a remote attacker, potentially leading to unauthorized access. The vulnerability is associated with the use of dangerous methods or functions in the web platform's interface.

Recommendations For ZKTeco BioTime version 8.5.5, consider restricting access to the hidden API endpoint until a patch is available. As a temporary workaround, limit the ability to reset the Administrator password to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-749

Related Identifiers

BDU:2023-04432

CVE-2023-38949

Affected Products

Zkteco Biotime

References · 7

• https://osv.dev/vulnerability/CVE-2023-38949 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-38949 · Security Note
• https://bdu.fstec.ru/vul/2023-04432 · Security Note
• https://claroty.com/team82/disclosure-dashboard/cve-2023-38949 · Note
• https://t.me/cvenotify/55764 · Telegram Post
• http://zkteco.com · Note
• https://twitter.com/gothburz/status/1918682593198784888 · Twitter Post