CVE-2023-4587 - Insecure direct object reference in ZKTeco ZEM800

Back Back to CVE browser

HIGH

Insecure direct object reference in ZKTeco ZEM800

Published Sep 4, 2023

8.3

HIGH

CVSS 3.1

EPSS 0.22%

Description

An IDOR vulnerability has been found in ZKTeco ZEM800 product affecting version 6.60. This vulnerability allows a local attacker to obtain registered user backup files or device configuration files over a local network or through a VPN server.

Affected products

Vendor ZKTeco Product ZEM800 Default
unaffected
- Version
  6.60
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

ZKTeco

ZEM800

unaffected

Version	Status	Constraints
6.60	affected	-

Vendor Zkteco Product Zem800 Default
n/a
- Version
  6.60
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Zkteco

Zem800

n/a

Version	Status	Constraints
6.60	affected	-

Remediation

Vendor solution

The gama has been updated and it is recommended to upgrade to the latest version available.

Weaknesses (1)

CWE-639

Authorization Bypass

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-54440
Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-direct-object-reference-zkteco-zem800
Third Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-54440		Advisory
https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-direct-object-reference-zkteco-zem800		Third Party Advisory