CVE-2023-38950

zkteco biotime

Published 3 Aug 2023 · updated 9 Jul 2026 · Analyzed

7.5 High · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 19 May 2025, with a remediation deadline of 9 Jun 2025 for US federal agencies.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload. This vulnerability was fixed in version 9.0.120240617.19506 of ZKBioTime.

References

claroty.com/team82/disclosure-dashboard/cve-2023-38950 · Third Party Advisory
sploitus.com/exploit?id=PACKETSTORM:177859 · Exploit
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38950 · US Government Resource
www.fortinet.com/content/dam/fortinet/assets/reports/report-incident-response-middle-east.pdf · Broken Link, Technical Description