Lucene search

KasperskyVULNRICHMENT:CVE-2023-3939

HistoryMay 21, 2024 - 9:45 a.m.

CVE-2023-3939 Multiple command injection in ZkTeco-based OEM devices

2024-05-2109:45:00

CWE-78

Kaspersky

github.com

cve-2023-3939

zkteco

command injection

proface x

smartec

zam170-nf

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

7.3 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.7%

JSON

Improper Neutralization of Special Elements used in an OS Command (‘OS
Command Injection’) vulnerability in ZkTeco-based OEM devices allows OS
Command Injection.
Since all the found command implementations are executed from the
superuser, their impact is the maximum possible.
This issue affects
ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec
ST-FR041ME and possibly others) with the ZAM170-NF-1.8.25-7354-Ver1.0.0
and possibly other.

CNA Affected

[
  {
    "defaultStatus": "unknown",
    "product": "ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0",
    "vendor": "ZkTeco",
    "versions": [
      {
        "status": "affected",
        "version": "ZAM170-NF-1.8.25-7354-Ver1.0.0"
      }
    ]
  }
]

References

github.com/klsecservices/Advisories/blob/master/K-ZkTeco-2023-002.md

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

7.3 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.7%

JSON

Related for VULNRICHMENT:CVE-2023-3939