CVE-2023-38955
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A vulnerability in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to obtain sensitive information about all managed devices, including their IP addresses and device names.
Risk Assessment
The organization is at risk of infrastructure information leakage, which could facilitate further attacks such as network scanning or device intrusion attempts.
Recommendation
Immediately update ZKTeco BioAccess IVS to the latest version and restrict access to the management interface to trusted networks only.
Other vulnerabilities in ZKTeco BioAccess IVS
See all- CVE-2023-38954Critical
A SQL injection vulnerability was discovered in ZKTeco BioAccess IVS version 3.3.1. It allows an attacker to manipulate database queries.
- CVE-2023-38958Medium
An access control issue in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to remotely open and close doors managed by the platform by sending a crafted web request.
- CVE-2023-38956High
A path traversal vulnerability in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to read arbitrary files by supplying a crafted payload.
Original NVD description (English source)
ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to obtain sensitive information about all managed devices, including their IP addresses and device names.