PT-2024-37308 · Zkteco · Zkteco Zkbio Cvsecurity V5000

Stux + 1 · Published 2024-06-15 · Updated 2025-07-17 · CVE-2024-6005

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: ZKTeco ZKBio CVSecurity V5000 version 4.1.0

Description: A vulnerability was found in the Department Section component, where the manipulation of the Department Name argument leads to cross-site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Recommendations: For ZKTeco ZKBio CVSecurity V5000 version 4.1.0, consider disabling the Department Section component or restricting access to it until a patch is available. Avoid using the Department Name argument in the affected component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Code Injection

Weakness Enumeration

CWE-79

CWE-94

Related Identifiers

CVE-2024-6005

Affected Products

Zkteco Zkbio Cvsecurity V5000

References · 7

• 🔥 https://vuldb.com/?submit.351241 · Exploit
• https://osv.dev/vulnerability/CVE-2024-6005 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6005 · Security Note
• https://vuldb.com/?ctiid.268693 · Note
• https://vuldb.com/?id.268693 · Note
• https://t.me/cvenotify/129266 · Telegram Post
• https://t.me/cvenotify/83395 · Telegram Post