CVE-2023-3943

Published: May 21, 2024Modified: Jun 17, 2026Deferred

10.0

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 6.0

Source: vulnerability@kaspersky.com (Secondary)

Description

Stack-based Buffer Overflow vulnerability in ZkTeco-based OEM devices allows, in some cases, the execution of arbitrary code. Due to the lack of protection mechanisms such as stack canaries and PIE, it is possible to successfully execute code even under restrictive conditions. This issue affects ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others) with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly others.

Related CWEs

CWE-121

Stack-based Buffer Overflow

A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).

References (2)

https://github.com/klsecservices/Advisories/blob/master/K-ZkTeco-2023-006.md

Source: vulnerability@kaspersky.com

https://github.com/klsecservices/Advisories/blob/master/K-ZkTeco-2023-006.md

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.