CVE-2023-38958
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
An access control issue in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to remotely open and close doors managed by the platform by sending a crafted web request.
Risk Assessment
The organization is exposed to unauthorized physical access to secured areas, potentially leading to theft, espionage, or data breaches.
Recommendation
Immediately update ZKTeco BioAccess IVS to the latest version and enforce authentication for all door management requests.
Other vulnerabilities in ZKTeco BioAccess IVS
See all- CVE-2023-38954Critical
A SQL injection vulnerability was discovered in ZKTeco BioAccess IVS version 3.3.1. It allows an attacker to manipulate database queries.
- CVE-2023-38956High
A path traversal vulnerability in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to read arbitrary files by supplying a crafted payload.
- CVE-2023-38955High
A vulnerability in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to obtain sensitive information about all managed devices, including their IP addresses and device names.
Original NVD description (English source)
An access control issue in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to arbitrarily close and open the doors managed by the platform remotely via sending a crafted web request.