CoreCVE
Back

CRITICAL

ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the server via crafted requests to /base/sftpsetting/ endpoints that abuse a path traversal issue in the Username field and a lack of input sanitization on the SSH Key field

Published Aug 3, 2023

Description

ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the server via crafted requests to /base/sftpsetting/ endpoints that abuse a path traversal issue in the Username field and a lack of input sanitization on the SSH Key field. Overwriting specific files may lead to arbitrary code execution as NT AUTHORITY\SYSTEM.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-22

Path Traversal

References (6)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Aug 3, 2023
Updated Jul 9, 2026
Reserved Jul 25, 2023
Link CVE-2023-38951
CISA Vulnrichment
Updated May 5, 2025
NVD
Status Modified
Modified Jul 9, 2026
Link CVE-2023-38951
Red Hat
Severity n/a
Public date n/a
Links CVE-2023-38951