CVE-2023-38950
ZKTeco · exploited in the wild
- Published
- 3 August 2023
- Last modified
- 9 July 2026
- CVSS
- 7.5 v3.1
- Severity
- high
- EPSS
- 84.7% (100th pct)
- CISA KEV
- Added 19 May 2025 KEV
- NVD status
- Analyzed
- Weaknesses
- CWE-22
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload. This vulnerability was fixed in version 9.0.120240617.19506 of ZKBioTime.
Exploitation
Added to the CISA Known Exploited Vulnerabilities catalogue on 19 May 2025, with a remediation due date of 9 June 2025 for US federal civilian agencies. CISA records no known ransomware campaign use.
Required action as published by CISA: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Affected products
| Product | Vendor | Type | Versions named |
|---|---|---|---|
| Biotime | ZKTeco | unknown | 8.5.4, 8.5.5, < 8.5.4, < 9.0.1 +3 |
References
- https://claroty.com/team82/disclosure-dashboard/cve-2023-38950 third-party
- https://claroty.com/team82/disclosure-dashboard/cve-2023-38950 third-party
- https://sploitus.com/exploit?id=PACKETSTORM:177859 exploit
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38950 government
- https://www.fortinet.com/content/dam/fortinet/assets/reports/report-incident-response-middle-east.pdf
Record assembled from NVD, CISA KEV 2026.09.04 and FIRST EPSS 2026-09-04. Affected products are those NVD's CPE configuration names that fall inside this site's scope; a CVE may affect products outside it.