ZkTeco ProFace X Path Traversal

The vulnerability of microprogrammed software in biometric terminals ZkTeco ProFace X, Smartec ST-FR043, and Smartec ST-FR041ME is related to errors in processing the relative path to the catalog. Exploiting this vulnerability can allow an attacker, operating remotely, to circumvent security...

CVE-2023-3941 Multiple arbitrary file writes in ZkTeco-based OEM devices

Relative Path Traversal vulnerability in ZkTeco-based OEM devices allows an attacker to write any file on the system with root privileges. This issue affects ZkTeco-based OEM devices ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others with the ZAM170-NF-1.8.25-7354-Ver1.0.0...

CVE-2023-3940 Multiple arbitrary file reads in ZkTeco-based OEM devices

Relative Path Traversal vulnerability in ZkTeco-based OEM devices allows an attacker to access any file on the system. This issue affects ZkTeco-based OEM devices ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others with the ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly others...

ZkTeco OEM SQL injection vulnerability

ZkTeco OEM is an intelligent system from the Chinese company ZkTeco. ZkTeco OEM suffers from a SQL injection vulnerability that arises from an improper neutralization of special elements used in SQL commands, allowing an attacker to impersonate another user or perform unauthorized actions. The...

PT-2024-4718

Name of the Vulnerable Software and Affected Versions: ZkTeco ProFace X versions with firmware ZAM170-NF-1.8.25 Smartec ST-FR043 versions with firmware ZAM170-NF-1.8.25 Smartec ST-FR041ME versions with firmware ZAM170-NF-1.8.25 Description: The issue is related to improper neutralization of speci...

PT-2024-4480

Name of the Vulnerable Software and Affected Versions ZkTeco ProFace X versions prior to the fixed version Smartec ST-FR043 versions prior to the fixed version Smartec ST-FR041ME versions prior to the fixed version ZkTeco-based OEM devices versions prior to the fixed version, including those with...

ZkTeco OEM security vulnerabilities

ZkTeco OEM is an intelligent system from the Chinese company ZkTeco. A security vulnerability exists in ZkTeco OEM that stems from incorrect neutralization of special elements used in operating system commands. The following products and versions are affected: ZkTeco ProFace X, Smartec ST-FR043,...

CVE-2023-3939: Improper Neutralization of Special Elements used in an OS Command

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in ZkTeco-based OEM devices allows OS Command Injection. Since all the found command implementations are executed from the superuser, their impact is the maximum possible. This issue affects...

PT-2024-4481 · Smartec +1 · Smartec St-Fr041Me +2

Name of the Vulnerable Software and Affected Versions: ZkTeco ProFace X versions ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly others Smartec ST-FR043 versions ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly others Smartec ST-FR041ME versions ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly others...