CVE-2023-38950

HIGHCVSS 7.5Known Exploited

CISA Known Exploited Vulnerability

https://www.zkteco.com/en/Security_Bulletinsibs ; https://nvd.nist.gov/vuln/detail/CVE-2023-38950

Remediation deadline: June 9, 2025

Description

ZKTeco BioTime contains a path traversal vulnerability in the iclock API that allows an unauthenticated attacker to read arbitrary files via supplying a crafted payload.

Timeline

Published:August 4th, 2023 3:15 AM

Last modified:July 9th, 2026 5:57 PM

Added to KEV:May 19th, 2025

CVSS Scoring

CVSS v3: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected Software

From NVD CPE configuration data

Vendors

zkteco

Products

biotime

Weaknesses (CWE)

CWE-22

References & Reports

Advisories, patches, and third-party reports

https://claroty.com/team82/disclosure-dashboard/cve-2023-38950Third Party Advisory
https://claroty.com/team82/disclosure-dashboard/cve-2023-38950Third Party Advisory
https://sploitus.com/exploit?id=PACKETSTORM:177859Exploit
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38950US Government Resource
https://www.fortinet.com/content/dam/fortinet/assets/reports/report-incident-response-middle-east.pdfBroken Link

Source: NIST NVD · Data may lag official sources by up to one minute