We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not validated for the type of user accessing the application by default. Privilege restrictions between non-admin and admin users are not enforced and any authenticated user can leverage admin functions without restriction by making direct requests to administrative endpoints.
Reserved 2023-07-25 | Published 2023-08-03 | Updated 2025-05-27 | Assigner mitreclaroty.com/team82/disclosure-dashboard/cve-2023-38952
github.com/...84/biotime-rce-8.5.5/blob/main/biotime_enum.py
krashconsulting.com/fury-of-fingers-biotime-rce/
Support options
