CyberSec.Space Logo
Back to CVE Browser

CVE-2023-38950

🔥 Known Exploited (CISA KEV)HIGH
7.5
CVSS Severity Score
EPSS Score88.2340%
EPSS Percentile95.61th
Published2023-08-03
Last Modified2026-07-09
Data SourcesNVDCISA KEVFIRST.org EPSS

Vulnerability Description

A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload. This vulnerability was fixed in version 9.0.120240617.19506 of ZKBioTime.

Affected Platforms (CPE)

📦
Zkteco

Biotime

< 9.0.1

References & Advisories

🔗 https://claroty.com/team82/disclosure-dashboard/cve-2023-38950
🔗 https://claroty.com/team82/disclosure-dashboard/cve-2023-38950
🔗 https://sploitus.com/exploit?id=PACKETSTORM:177859
🔗 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38950
🔗 https://www.fortinet.com/content/dam/fortinet/assets/reports/report-incident-response-middle-east.pdf

Related Vulnerabilities

CVE-2025-151285.5

A vulnerability was detected in ZKTeco BioTime up to 9.0.3/9.0.4/9.5.2. This affects an unknown part of the file /base/safe_settin...

CVE-2024-139666.9

ZKTeco BioTime allows unauthenticated attackers to enumerate usernames and log in as any user with a password unchanged from the d...

CVE-2024-65235.3

A vulnerability was found in ZKTeco BioTime up to 9.5.2. It has been classified as problematic. Affected is an unknown function of...

CVE-2023-511427.5

An issue in ZKTeco BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive information.