CVE-2023-3938

2024-05-2110:15:08

CWE-89

[email protected]

web.nvd.nist.gov

sql injection

zkteco

oem devices

unauthorized access

CVSS3

4.6

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

7.6

Confidence

Low

EPSS

Percentile

9.0%

JSON

Improper Neutralization of Special Elements used in an SQL Command (‘SQL
Injection’) vulnerability in ZkTeco-based OEM devices allows an
attacker
to authenticate under any user from the device database.

This issue affects

ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec
ST-FR041ME and possibly others) with the ZAM170-NF-1.8.25-7354-Ver1.0.0
and possibly others.

CNA Affected

[
  {
    "defaultStatus": "unknown",
    "product": "ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0",
    "vendor": "ZkTeco",
    "versions": [
      {
        "status": "affected",
        "version": "ZAM170-NF-1.8.25-7354-Ver1.0.0"
      }
    ]
  }
]