Skip to content
COOEY

EXPOSURES › CVE-2023-38951

CVE-2023-38951

CRITICAL
DETAIL
SourceNVD · cve Published2023-08-03 CVSS9.8 Referencehttps://nvd.nist.gov/vuln/detail/CVE-2023-38951 ↗
⚡ RCE SHAME 50/100 rce

ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the server via crafted requests to /base/sftpsetting/ endpoints that abuse a path traversal issue in the Username field and a lack of input sani

▸ RECOMMENDED ACTION  Remote code execution — patch the affected products on priority.

PLAYERS IMPLICATED
zkteco · vendorbiotime · product
DESCRIPTION

ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the server via crafted requests to /base/sftpsetting/ endpoints that abuse a path traversal issue in the Username field and a lack of input sanitization on the SSH Key field. Overwriting specific files may lead to arbitrary code execution as NT AUTHORITY\SYSTEM.

AFFECTED FEDRAMP PRODUCTS · 0
No correlated FedRAMP products.