Back

CVE-2023-3938

May 21, 2024, 12:37 p.m.

Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.

Products

ZkTeco-based OEM devices

  • ZAM170-NF-1.8.25

ZkTeco-based OEM devices

  • ZAM170-NF-1.8.25-7354-Ver1.0.0

Source

vulnerability@kaspersky.com

Tags

CWE-89
2024-05-21
CVE-2023-3938
vulnerability@kaspersky.com

CVE-2023-3938 details

Published : May 21, 2024, 10:15 a.m.
Last Modified : May 21, 2024, 12:37 p.m.

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ZkTeco-based OEM devices allows an attacker to authenticate under any user from the device database. This issue affects  ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others) with the ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly others.

CVSS Score

1 2 3 4.6 5 6 7 8 9 10

Weakness

Weakness Name Description

CVSS Data

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

Base Score

4.6

Exploitability Score

Impact Score

Base Severity

MEDIUM

Vector String : CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

URL Source
https://github.com/klsecservices/Advisories/blob/master/K-ZkTeco-2023-001.md vulnerability@kaspersky.com
This website uses the NVD API, but is not approved or certified by it.