CVE-2023-38950

Description

A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload.

Reserved 2023-07-25 | Published 2023-08-03 | Updated 2025-05-21 | Assigner mitre

CISA Known Exploited Vulnerability

Date added 2025-05-19 | Due date 2025-06-09

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

References

zkteco.com

claroty.com/team82/disclosure-dashboard/cve-2023-38950

cve.org (CVE-2023-38950)

nvd.nist.gov (CVE-2023-38950)

Download JSON