CVE-2023-38954
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A SQL injection vulnerability was discovered in ZKTeco BioAccess IVS version 3.3.1. It allows an attacker to manipulate database queries.
Risk Assessment
The risk includes unauthorized access to sensitive data, its modification or deletion, potentially compromising the access control system's integrity.
Recommendation
Immediately update the software to the latest version and implement parameterized SQL queries to eliminate the vulnerability.
Other vulnerabilities in ZKTeco BioAccess IVS
See all- CVE-2023-38958Medium
An access control issue in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to remotely open and close doors managed by the platform by sending a crafted web request.
- CVE-2023-38956High
A path traversal vulnerability in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to read arbitrary files by supplying a crafted payload.
- CVE-2023-38955High
A vulnerability in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to obtain sensitive information about all managed devices, including their IP addresses and device names.
Original NVD description (English source)
ZKTeco BioAccess IVS v3.3.1 was discovered to contain a SQL injection vulnerability.