CVE-2023-38952
HighCVSS 7.5Exploitation Probability (EPSS)
High risk82th percentile - higher than 82% of all known CVEs
Summary
An insecure access control vulnerability in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate privileges because session IDs are not validated against user type. Any authenticated user can access administrative functions without restriction by making direct requests to admin endpoints.
Risk Assessment
The risk is that any authenticated user can gain full administrative control, potentially modifying system configuration, user data, or logs, leading to data integrity and confidentiality breaches.
Recommendation
Immediately update ZKTeco BioTime to the latest available version that fixes this vulnerability. Until then, restrict system access to trusted users and monitor for unusual requests to administrative endpoints.
Other vulnerabilities in ZKTeco BioTime
See all- CVE-2023-38951Critical
A vulnerability in ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the server. It exploits a path traversal issue in the Username field and lack of input sanitization on the SSH Key field in /base/sftpsetting/ endpoints.
- CVE-2023-38950HighActively exploited
A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via a crafted payload. The flaw is fixed in version 9.0.120240617.19506.
- CVE-2025-15128Medium
A vulnerability was detected in ZKTeco BioTime up to versions 9.0.3/9.0.4/9.5.2, affecting an unknown part of the file /base/safe_setting/ of the Endpoint component. Manipulating the argument backup_encryption_password_decrypt/export_encryption_password_decrypt results in unprotected storage of credentials.
- CVE-2023-51142High
An issue in ZKTeco BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive information. The vulnerability stems from improper access control to data.
- CVE-2023-38949High
A vulnerability in a hidden API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to arbitrarily reset the Administrator password via a crafted web request.
Original NVD description (English source)
Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not validated for the type of user accessing the application by default. Privilege restrictions between non-admin and admin users are not enforced and any authenticated user can leverage admin functions without restriction by making direct requests to administrative endpoints.