CVE-2023-38954

CriticalCVSS 9.8

Published: 03/08/2023(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.50%

39th percentile - higher than 39% of all known CVEs

Summary

A SQL injection vulnerability was discovered in ZKTeco BioAccess IVS version 3.3.1. It allows an attacker to manipulate database queries.

Risk Assessment

The risk includes unauthorized access to sensitive data, its modification or deletion, potentially compromising the access control system's integrity.

Recommendation

Immediately update the software to the latest version and implement parameterized SQL queries to eliminate the vulnerability.

Original NVD description (English source)

ZKTeco BioAccess IVS v3.3.1 was discovered to contain a SQL injection vulnerability.