CVE-2023-38956
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
A path traversal vulnerability in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to read arbitrary files by supplying a crafted payload.
Risk Assessment
Attackers can access sensitive system files, configuration files, or user data, leading to information disclosure and potential attack escalation.
Recommendation
Immediately update ZKTeco BioAccess IVS to the latest version and implement file path validation mechanisms.
Other vulnerabilities in ZKTeco BioAccess IVS
See all- CVE-2023-38954Critical
A SQL injection vulnerability was discovered in ZKTeco BioAccess IVS version 3.3.1. It allows an attacker to manipulate database queries.
- CVE-2023-38958Medium
An access control issue in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to remotely open and close doors managed by the platform by sending a crafted web request.
- CVE-2023-38955High
A vulnerability in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to obtain sensitive information about all managed devices, including their IP addresses and device names.
Original NVD description (English source)
A path traversal vulnerability in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload.