PT-2024-18239 · Zkteco · Zkbio Access Ivs

Hussein Amer · Published 2024-02-21 · Updated 2024-05-17 · CVE-2024-1706

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ZKTeco ZKBio Access IVS versions up to 3.3.2

Description A problematic issue has been found in the Department Name Search Bar component, allowing for cross-site scripting through the manipulation of input, such as <marquee>hi. This can be exploited remotely. The issue has been publicly disclosed.

Recommendations For ZKTeco ZKBio Access IVS versions up to 3.3.2, consider restricting access to the Department Name Search Bar component until a fix is available. As a temporary workaround, avoid using the input field in the Department Name Search Bar to minimize the risk of exploitation.

Exploit

Fix

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2024-1706

Affected Products

Zkbio Access Ivs

References · 9

• 🔥 https://gist.githubusercontent.com/whiteman007/8d3a09991de4ef336937ba91c07b7856/raw/adc00538d7a8c3c54bde4797a10d9b6af393711d/gistfile1.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-1706 · Security Note
• https://osv.dev/vulnerability/CVE-2024-1706 · Vendor Advisory
• https://twitter.com/CVEnew/status/1760368334925681025 · Twitter Post
• https://vuldb.com/?ctiid.254396 · Note
• https://zkteco.com/en/Security_Bulletinsibs/21 · Note
• https://vuldb.com/?submit.280084 · Note
• https://vuldb.com/?id.254396 · Note
• https://vuldb.com/?submit.280083 · Note