Lucene search

KasperskyVULNRICHMENT:CVE-2023-3943

HistoryMay 21, 2024 - 1:32 p.m.

CVE-2023-3943 Multiple buffer overflow in ZkTeco-based OEM devices

2024-05-2113:32:47

CWE-121

Kaspersky

github.com

cve-2023-3943

buffer overflow

zkteco

oem devices

arbitrary code execution

protection mechanisms

firmware

zam170-nf-1.8.25-7354-ver1.0.0

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Stack-based Buffer Overflow vulnerability in ZkTeco-based OEM devices allows, in some cases, the execution of arbitrary code. Due to the lack of protection mechanisms such as stack canaries and PIE, it is possible to successfully execute code even under restrictive conditions.

This issue affects
ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others)

with firmware
ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly others.

CNA Affected

[
  {
    "defaultStatus": "unknown",
    "product": "ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0",
    "vendor": "ZkTeco",
    "versions": [
      {
        "status": "affected",
        "version": "ZAM170-NF-1.8.25-7354-Ver1.0.0"
      }
    ]
  }
]

References

github.com/klsecservices/Advisories/blob/master/K-ZkTeco-2023-006.md

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Related for VULNRICHMENT:CVE-2023-3943