CVE-2023-38952

Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not validated for the type of user accessing the application by default. Privilege restrictions between non-admin and admin users are not enforced and any authenticated user can leverage admin functions without restriction by making direct requests to administrative endpoints.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
http://zkteco.com	Product
https://claroty.com/team82/disclosure-dashboard/cve-2023-38952	Third Party Advisory
https://github.com/omair2084/biotime-rce-8.5.5/blob/main/biotime_enum.py
https://krashconsulting.com/fury-of-fingers-biotime-rce/
http://zkteco.com	Product
https://claroty.com/team82/disclosure-dashboard/cve-2023-38952	Third Party Advisory
https://sploitus.com/exploit?id=PACKETSTORM:177859

Configurations

Configuration 1 (hide)

cpe:2.3:a:zkteco:biotime:8.5.5:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-08-03 23:15

Updated : 2025-05-27 20:15

NVD link : CVE-2023-38952

Mitre link : CVE-2023-38952

CVE.ORG link : CVE-2023-38952

JSON object : View

Products Affected

zkteco

biotime

CWE

CWE-552

Files or Directories Accessible to External Parties

{"id": "CVE-2023-38952", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2023-08-03T23:15:11.473", "references": [{"url": "http://zkteco.com", "tags": ["Product"], "source": "[email protected]"}, {"url": "https://claroty.com/team82/disclosure-dashboard/cve-2023-38952", "tags": ["Third Party Advisory"], "source": "[email protected]"}, {"url": "https://github.com/omair2084/biotime-rce-8.5.5/blob/main/biotime_enum.py", "source": "[email protected]"}, {"url": "https://krashconsulting.com/fury-of-fingers-biotime-rce/", "source": "[email protected]"}, {"url": "http://zkteco.com", "tags": ["Product"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://claroty.com/team82/disclosure-dashboard/cve-2023-38952", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://sploitus.com/exploit?id=PACKETSTORM:177859", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-552"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-552"}]}], "descriptions": [{"lang": "en", "value": "Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not validated for the type of user accessing the application by default. Privilege restrictions between non-admin and admin users are not enforced and any authenticated user can leverage admin functions without restriction by making direct requests to administrative endpoints."}], "lastModified": "2025-05-27T20:15:23.890", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zkteco:biotime:8.5.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1C1ABA20-2F3E-4EB4-8AAB-0C3C93A382A0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}