PT-2024-4482 · Zkteco+1 · Zkteco Proface X+2

Georgy Kiguradze

·

Published

2024-05-21

·

Updated

2024-05-22

·

CVE-2023-3939

CVSS v3.1

10

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions ZkTeco-based OEM devices version ZAM170-NF-1.8.25-7354-Ver1.0.0
Description The issue is related to an OS Command Injection vulnerability, which allows for the execution of arbitrary commands. This vulnerability affects ZkTeco-based OEM devices, including ZkTeco ProFace X, Smartec ST-FR043, and Smartec ST-FR041ME, and possibly others. The impact of this issue is maximum possible since all found command implementations are executed from the superuser.
Recommendations For ZkTeco-based OEM devices version ZAM170-NF-1.8.25-7354-Ver1.0.0, consider disabling the vulnerable command implementations until a patch is available. Restrict access to the affected devices to minimize the risk of exploitation. Avoid using the vulnerable firmware version until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2024-04985
CVE-2023-3939

Affected Products

Smartec St-Fr041Me
Smartec St-Fr043
Zkteco Proface X