PT-2024-19634 · Zkteco · Zkteco Zkbio Wdms

Secatgourity · Published 2024-02-23 · Updated 2025-06-06 · CVE-2024-22988

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions zkteco zkbio WDMS version 8.0.5

Description An issue in the software allows an attacker to execute arbitrary code via the "/files/backup/" component.

Recommendations For zkteco zkbio WDMS version 8.0.5, consider restricting access to the "/files/backup/" component until a patch is available. As a temporary workaround, avoid using the backup functionality in the affected version to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2024-22988

Affected Products

Zkteco Zkbio Wdms

References · 11

• https://osv.dev/vulnerability/CVE-2024-22988 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22988 · Security Note
• https://vicarius.io/vsociety/posts/revealing-cve-2024-22988-a-unique-dive-into-exploiting-access-control-gaps-in-zkbio-wdms-uncover-the-untold-crafted-for-beginners-with-a-rare-glimpse-into-pentesting-strategies · Note
• https://twitter.com/CVEnew/status/1761162110929686652 · Twitter Post
• https://t.me/cvenotify/124905 · Telegram Post
• https://gist.github.com/whiteman007/b50a9b64007a5d7bcb7a8bee61d2cb47 · Note
• https://zkteco.com · Note
• https://twitter.com/VulmonFeeds/status/1762086684978528472 · Twitter Post
• https://zkteco.com/en/Security_Bulletinsibs/12 · Note
• https://t.me/cvenotify/119853 · Telegram Post
• https://t.me/cvenotify/72342 · Telegram Post