ZkTeco Relative Path Traversal Vulnerability Affects Multiple Devices
CVE-2023-3940

7.5HIGH

Key Information:

Vendor

Zkteco

Status
Zkteco-based Oem Devices With Firmware Zam170-nf-1.8.25-7354-ver1.0.0
Vendor
CVE Published:
21 May 2024

What is CVE-2023-3940?

A relative path traversal vulnerability exists in ZkTeco-based OEM devices, permitting attackers to access arbitrary files on the system. This vulnerability potentially exposes sensitive data and compromises the security integrity of the device. Affected models primarily include ZkTeco ProFace X and various Smartec devices, particularly those using specific firmware versions such as ZAM170-NF-1.8.25-7354-Ver1.0.0. Proper security measures should be implemented to mitigate risks associated with unauthorized file access.

Affected Version(s)

ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0 ZAM170-NF-1.8.25-7354-Ver1.0.0

References

https://github.com/klsecservices/Advisories/blob/master/K...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

The vulnerability was discovered by Georgy Kiguradze from Kaspersky
.