CVE-2023-38954

CVE-2023-38954 affects ZKTeco BioAccess IVS v3.3.1. The root cause is improper protection of the SQL query structure, enabling a SQL injection that could be exploited remotely. Documented impact is high (as per CVSS evaluation). There is no publicly documented patch in the provided sources; as a ...

CVE-2023-38956

CVE-2023-38956 affects ZKTeco BioAccess IVS v3.3.1. A path traversal flaw (failure to properly filter path elements) can allow unauthenticated attackers to read arbitrary files by sending a crafted payload. The vulnerability is documented across multiple sources (CNVD, RH Red Hat, NVD) with consi...

CVE-2023-38949

CVE-2023-38949 affects ZKTeco BioTime v8.5.5 via a hidden API in the web interface that can be abused by unauthenticated attackers to reset the Administrator password through a crafted request. The root cause is an exposed, unauthenticated password-reset pathway in the BioTime web platform; impac...

PT-2023-4121

Name of the Vulnerable Software and Affected Versions ZKTeco BioTime version 8.5.5 Description The issue is related to a path traversal vulnerability in the iclock API, which can be exploited by supplying a crafted payload, allowing unauthenticated attackers to read arbitrary files. This...

PT-2023-4124

Name of the Vulnerable Software and Affected Versions ZKTeco BioTime version 8.5.5 Description The issue is related to insecure access control in the ZKTeco BioTime platform, which can be exploited by sending a specially crafted HTTP request. This allows an unauthenticated attacker to gain...

PT-2023-4123 · Zkteco · Zkteco Biotime

Name of the Vulnerable Software and Affected Versions: ZKTeco BioTime version 8.5.5 Description: The issue is related to a hidden API in the ZKTeco BioTime platform, which allows unauthenticated attackers to reset the Administrator password via a crafted web request. This can be exploited by a...

PT-2023-4122 · Zkteco · Zkteco Biotime

Name of the Vulnerable Software and Affected Versions: ZKTeco BioTime version 8.5.5 Description: The issue is related to a path traversal vulnerability in the implementation of the SFTP protocol, which can be exploited by an attacker to write arbitrary files. This can be achieved by using a...

PT-2023-4126 · Zkteco · Zkteco Bioaccess Ivs

Name of the Vulnerable Software and Affected Versions: ZKTeco BioAccess IVS version 3.3.1 Description: The issue is related to insufficient protection of service data in the ZKTeco BioAccess IVS web platform, which can be exploited by remote attackers to gain unauthorized access to sensitive...

PT-2023-4129 · Zkteco · Zkteco Bioaccess Ivs

Name of the Vulnerable Software and Affected Versions: ZKTeco BioAccess IVS version 3.3.1 Description: The issue is related to a path traversal vulnerability, which can be exploited by a remote attacker to read arbitrary files. This is achieved by supplying a crafted payload, allowing unauthorize...

ZKTeco ZEM/ZMM 8.88 - Missing Authentication Vulnerability

Exploit Title: ZKTeco ZEM/ZMM 8.88 - Missing Authentication Exploit Author: RedTeam Pentesting GmbH CVE: CVE-2022-42953 Advisory: Missing Authentication in ZKTeco ZEM/ZMM Web Interface The ZKTeco time attendance device does not require authentication to use the web interface, exposing the databas...

ZKTeco ZEM/ZMM 8.88 - Missing Authentication

Exploit Title: ZKTeco ZEM/ZMM 8.88 - Missing Authentication Exploit Author: RedTeam Pentesting GmbH CVE: CVE-2022-42953 Advisory: Missing Authentication in ZKTeco ZEM/ZMM Web Interface The ZKTeco time attendance device does not require authentication to use the web interface, exposing the databas...

Exploit for CVE-2023-31711

CVE-2023-31711 Incorrect Access Control in ZKTECO allows...

CVE-2022-42953

Certain ZKTeco products ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM allow access to sensitive information via direct requests for the form/DataApp?style=1 and form/DataApp?style=0 URLs. The affected versions may be before 8.88 ZEM500-510-560-760, ZEM600-800, ZEM720 and 15.00 ZMM200-220-210. The...

CVE-2022-42953

Certain ZKTeco products ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM allow access to sensitive information via direct requests for the form/DataApp?style=1 and form/DataApp?style=0 URLs. The affected versions may be before 8.88 ZEM500-510-560-760, ZEM600-800, ZEM720 and 15.00 ZMM200-220-210. The...

Information disclosure

Certain ZKTeco products ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM allow access to sensitive information via direct requests for the form/DataApp?style=1 and form/DataApp?style=0 URLs. The affected versions may be before 8.88 ZEM500-510-560-760, ZEM600-800, ZEM720 and 15.00 ZMM200-220-210. The...

CVE-2022-42953

Certain ZKTeco products ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM allow access to sensitive information via direct requests for the form/DataApp?style=1 and form/DataApp?style=0 URLs. The affected versions may be before 8.88 ZEM500-510-560-760, ZEM600-800, ZEM720 and 15.00 ZMM200-220-210. The...

CVE-2022-42953

Certain ZKTeco products ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM allow access to sensitive information via direct requests for the form/DataApp?style=1 and form/DataApp?style=0 URLs. The affected versions may be before 8.88 ZEM500-510-560-760, ZEM600-800, ZEM720 and 15.00 ZMM200-220-210. The...

EUVD-2022-46008

Certain ZKTeco products ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM allow access to sensitive information via direct requests for the form/DataApp?style=1 and form/DataApp?style=0 URLs. The affected versions may be before 8.88 ZEM500-510-560-760, ZEM600-800, ZEM720 and 15.00 ZMM200-220-210. The...

CVE-2022-42953

CVE-2022-42953 affects ZKTeco ZEM500-510-560-760, ZEM600-800, ZEM720 (pre-8.88) and ZMM200-220-210 (pre-15.00). The underlying issue is a missing authentication vulnerability in the ZKTeco Web Interface, which could expose sensitive information via direct requests to form/DataApp?style=1 and form...

PT-2022-26677 · Zkteco · Zem560 +9

Name of the Vulnerable Software and Affected Versions: ZKTeco ZEM500-510-560-760 versions prior to 8.88 ZKTeco ZEM600-800 versions prior to 8.88 ZKTeco ZEM720 versions prior to 8.88 ZKTeco ZMM200-220-210 versions prior to 15.00 Description: Certain ZKTeco products allow access to sensitive...