CVE-2023-38950
HIGH severity · CVSS 7.5 · Path traversal · actively exploited (CISA KEV)
7.5CVSS HIGH exploited
Actively exploited in the wild (CISA Known Exploited Vulnerabilities).
Added to KEV 2025-05-19. US federal agencies must patch by 2025-06-09.
Summary
A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload. This vulnerability was fixed in version 9.0.120240617.19506 of ZKBioTime.
Impact & exploitability
Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
Confidentiality impactHigh
Integrity impactNone
Availability impactNone
Exploit probability (EPSS)85%
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products we track (1)
Recommendation
This vulnerability is being actively exploited in the wild — patch affected products urgently. Open any affected product above for its exact safe version.
Additional information
- NVD record
- https://claroty.com/team82/disclosure-dashboard/cve-2023-38950Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38950
- https://www.fortinet.com/content/dam/fortinet/assets/reports/report-incident-response-middle-east.pdf
- https://sploitus.com/exploit?id=PACKETSTORM:177859Exploit