High severity · published Aug 3, 2023
CVE-2023-38950
ZKTeco BioTime Path Traversal Vulnerability
In wildKEV
7.5
CVSS
92.5%
EPSS
Yes
On KEV
Description
A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload. This vulnerability was fixed in version 9.0.120240617.19506 of ZKBioTime.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)92.5% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed May 19, 2025
Federal remediation dueJun 9, 2025
Ransomware campaign useNot known
Affected products
Which versions
BI
Biotime · Zkteco
before 9.0.1 · source: NVD, KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-38950
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-38950
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
claroty.com
https://claroty.com/team82/disclosure-dashboard/cve-2023-38950
More from Biotime
9.8
CVE-2023-38951
ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the server via crafted requests to…
7.5
CVE-2023-51142
An issue in ZKTeco BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive information
7.5
CVE-2023-38952
Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not validated for the type…
7.5
CVE-2023-38949
An issue in a hidden API in ZKTeco BioTime v8.5.5 allows unauthenticated attackers to arbitrarily reset the Administrator password via a crafted web request
7.3
CVE-2026-108798
ZKTeco BioTime hard-coded key