CVE-2023-38951
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk87th percentile - higher than 87% of all known CVEs
Summary
A vulnerability in ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the server. It exploits a path traversal issue in the Username field and lack of input sanitization on the SSH Key field in /base/sftpsetting/ endpoints.
Risk Assessment
An attacker can overwrite critical system files, potentially leading to remote code execution as NT AUTHORITY\SYSTEM, resulting in full server compromise.
Recommendation
Immediately update ZKTeco BioTime to version 9.0.1 (20240617.19506) or later. If updating is not possible, restrict access to /base/sftpsetting/ endpoints to trusted IP addresses only.
Other vulnerabilities in ZKTeco BioTime
See all- CVE-2023-38950HighActively exploited
A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via a crafted payload. The flaw is fixed in version 9.0.120240617.19506.
- CVE-2026-108798High
A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206 involving the use of a hard-coded cryptographic key. The attack may be launched remotely. The issue is fixed in version 9.5.6 Build 3623.
- CVE-2026-108797Medium
A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206 affecting unknown code of the file /personnel/api/employees/ in the Employee REST API component. The manipulation leads to authorization bypass and the attack may be initiated remotely.
- CVE-2026-108796Medium
A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206 affecting an unknown part of the file /iclock/finger_data/ in the Biometric Data Endpoint component. Manipulating the emp_code argument can lead to authorization bypass and the attack can be launched remotely.
- CVE-2026-108795Medium
A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206 affecting some unknown functionality of the file /base/api/systemSettings in the System Settings API component. The manipulation results in improper access controls and the attack can be initiated remotely.
- CVE-2026-108794Medium
A security vulnerability has been detected in ZKTeco BioTime 9.5.6 Build 20260130.3206 affecting an unknown functionality of the file /base/api/v1.0/systemSettings/db_migrate_setting/ in the Database Migration Functionality component. Such manipulation leads to SQL injection and the attack can be launched remotely.
- CVE-2025-15128Medium
A vulnerability was detected in ZKTeco BioTime up to versions 9.0.3/9.0.4/9.5.2, affecting an unknown part of the file /base/safe_setting/ of the Endpoint component. Manipulating the argument backup_encryption_password_decrypt/export_encryption_password_decrypt results in unprotected storage of credentials.
- CVE-2023-51142High
An issue in ZKTeco BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive information. The vulnerability stems from improper access control to data.
- CVE-2023-38952High
An insecure access control vulnerability in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate privileges because session IDs are not validated against user type. Any authenticated user can access administrative functions without restriction by making direct requests to admin endpoints.
- CVE-2023-38949High
A vulnerability in a hidden API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to arbitrarily reset the Administrator password via a crafted web request.
Original NVD description (English source)
ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the server via crafted requests to /base/sftpsetting/ endpoints that abuse a path traversal issue in the Username field and a lack of input sanitization on the SSH Key field. Overwriting specific files may lead to arbitrary code execution as NT AUTHORITY\SYSTEM.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS