CVE-2023-38952

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-38952
Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not validated for the type of user accessing the application by default. Privilege restrictions between non-admin and admin users are not enforced and any authenticated user can leverage admin functions without restriction by making direct requests to administrative endpoints.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
http://zkteco.com Product
https://claroty.com/team82/disclosure-dashboard/cve-2023-38952 Third Party Advisory
https://github.com/omair2084/biotime-rce-8.5.5/blob/main/biotime_enum.py
https://krashconsulting.com/fury-of-fingers-biotime-rce/
http://zkteco.com Product
https://claroty.com/team82/disclosure-dashboard/cve-2023-38952 Third Party Advisory
https://sploitus.com/exploit?id=PACKETSTORM:177859
Configurations

Configuration 1 (hide)

cpe:2.3:a:zkteco:biotime:8.5.5:*:*:*:*:*:*:*
History

19 May 2025, 21:15

Type Values Removed Values Added
References
  • () https://github.com/omair2084/biotime-rce-8.5.5/blob/main/biotime_enum.py -
  • () https://krashconsulting.com/fury-of-fingers-biotime-rce/ -
Summary (en) Insecure access control in ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read sensitive backup files and access sensitive information such as user credentials via sending a crafted HTTP request to the static files resources of the system. (en) Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not validated for the type of user accessing the application by default. Privilege restrictions between non-admin and admin users are not enforced and any authenticated user can leverage admin functions without restriction by making direct requests to administrative endpoints.

05 May 2025, 15:15

Type Values Removed Values Added
References
  • () https://sploitus.com/exploit?id=PACKETSTORM:177859 -

21 Nov 2024, 08:14

Type Values Removed Values Added
References () http://zkteco.com - Product () http://zkteco.com - Product
References () https://claroty.com/team82/disclosure-dashboard/cve-2023-38952 - Third Party Advisory () https://claroty.com/team82/disclosure-dashboard/cve-2023-38952 - Third Party Advisory
Information

Published : 2023-08-03 23:15

Updated : 2025-05-19 21:15

NVD link : CVE-2023-38952

Mitre link : CVE-2023-38952

CVE.ORG link : CVE-2023-38952

JSON object : View

Products Affected

zkteco

  • biotime
CWE
CWE-552

Files or Directories Accessible to External Parties