CVE-2023-38951

Published: Aug 3, 2023Modified: Jul 9, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the server via crafted requests to /base/sftpsetting/ endpoints that abuse a path traversal issue in the Username field and a lack of input sanitization on the SSH Key field. Overwriting specific files may lead to arbitrary code execution as NT AUTHORITY\SYSTEM.

Affected (1)

Products: Zkteco: Biotime

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Zkteco Biotime	Version 8.5.5

Related CWEs

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (7)

https://claroty.com/team82/disclosure-dashboard/cve-2023-38951

Source: cve@mitre.org

Third Party Advisory

https://github.com/omair2084/biotime-rce-8.5.5/blob/main/biotime_enum.py

Source: cve@mitre.org

https://krashconsulting.com/fury-of-fingers-biotime-rce/

Source: cve@mitre.org

https://www.zkteco.com/en/ZKBio_Time/ZKBioTime#Download

Source: cve@mitre.org

https://www.zkteco.com/en/announcement

Source: cve@mitre.org

https://claroty.com/team82/disclosure-dashboard/cve-2023-38951

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://sploitus.com/exploit?id=PACKETSTORM:177859

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.