CVE-2023-38949

moderate-risk

Published 2023-08-03

An issue in a hidden API in ZKTeco BioTime v8.5.5 allows unauthenticated attackers to arbitrarily reset the Administrator password via a crafted web request.

Do I need to act?

0.14% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (1)

Biotime

Affected Vendors

Zkteco

References (4)

Product http://zkteco.com

Third Party Advisory https://claroty.com/team82/disclosure-dashboard/cve-2023-38949

Product http://zkteco.com

Third Party Advisory https://claroty.com/team82/disclosure-dashboard/cve-2023-38949

/ 100

moderate-risk

Severity 26/34 · High

Exploitability 1/34 · Minimal

Exposure 5/34 · Minimal