User Enumeration and Default Password Vulnerability in ZKTeco BioTime

CVE-2024-13966

What is CVE-2024-13966?

ZKTeco's BioTime software is susceptible to a serious vulnerability that allows unauthenticated attackers to enumerate usernames within the system. Furthermore, attackers can exploit this flaw to log in as any user whose password remains unchanged from the default value of '123456'. It is crucial for users to immediately change their passwords to enhance security and prevent unauthorized access. Users can find the password change option under the Attendance Settings tab labeled as 'Self-Password'.

References