PULSE
EN
FEED
ransomakira reclama a Videk · GB · Technologyransomakira reclama a Boyle, Pecharich, Cline, Whittington and Stallings · Professional Servicesransom0x00 reclama a bienestarempresarial · MX · Professional Servicesransomiah6477 reclama a middleby · US · Manufacturingransomiah6477 reclama a sunshine-mills · Agriculture and Food Productionransomakira reclama a Svd (Sun Valley Dairy) · US · Agriculture and Food Productionransomqilin reclama a Hocon Gas · NG · Energy & Utilitiesransomqilin reclama a HyperGen · US · Technologyransomqilin reclama a Chattanooga Shooting Supplies · US · Retail & E-Commerceransomqilin reclama a Brame Telecom · BR · Technologyransomiah6477 reclama a hensley · Otherransomvexy ransomware reclama a Enchanted Fine Jewellery · IN · Retail & E-Commerceransomiah6477 reclama a buckle · Retail & E-Commerceransomiah6477 reclama a camden-living · GB · Hospitalityransomakira reclama a Videk · GB · Technologyransomakira reclama a Boyle, Pecharich, Cline, Whittington and Stallings · Professional Servicesransom0x00 reclama a bienestarempresarial · MX · Professional Servicesransomiah6477 reclama a middleby · US · Manufacturingransomiah6477 reclama a sunshine-mills · Agriculture and Food Productionransomakira reclama a Svd (Sun Valley Dairy) · US · Agriculture and Food Productionransomqilin reclama a Hocon Gas · NG · Energy & Utilitiesransomqilin reclama a HyperGen · US · Technologyransomqilin reclama a Chattanooga Shooting Supplies · US · Retail & E-Commerceransomqilin reclama a Brame Telecom · BR · Technologyransomiah6477 reclama a hensley · Otherransomvexy ransomware reclama a Enchanted Fine Jewellery · IN · Retail & E-Commerceransomiah6477 reclama a buckle · Retail & E-Commerceransomiah6477 reclama a camden-living · GB · Hospitality
← Todos los CVEs
CVE Watch9 jul 2026

CVE-2023-38950

ZKTeco BioTime Path Traversal Vulnerability

CVSS

7.5

Alto

EPSS

92.5%

p100

KEV

SÍ

19 may 2025

Exploit Today

80

0-100

Publicado: 3 ago 2023 · Última mod.: 9 jul 2026 · CWE-22

EPSS · 30d
84.7%EPSS · 30 días92.5%
2026-09-162026-10-14
Ficha del catálogo KEV

Producto

ZKTeco / BioTime

Vulnerabilidad

ZKTeco BioTime Path Traversal Vulnerability

Añadido a KEV

19 may 2025

Remediar antes de

9 jun 2025

Uso conocido en ransomware

No

Descripción resumida

ZKTeco BioTime contains a path traversal vulnerability in the iclock API that allows an unauthenticated attacker to read arbitrary files via supplying a crafted payload.

Acción requerida

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notas

https://www.zkteco.com/en/Security_Bulletinsibs ; https://nvd.nist.gov/vuln/detail/CVE-2023-38950

Descripción técnica

A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload. This vulnerability was fixed in version 9.0.120240617.19506 of ZKBioTime.

Referencias oficiales
CVEs relacionados
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-104025—
—
———Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the "Preview with... -> Associated application" action (Shift+Ctrl+O) to execute an arbitrary program already present on the victim's system, with no warning dialog. The function validates only outname (PeaZip's own temporary directory) with checkfiledirname, while the string actually executed is the concatenation outname+tempstring; tempstring is taken verbatim from the archive entry name (StringGridList.Cells[12,...]) and is never validated. checkfiledirname (list_utils.pas) rejects control and reserved characters in the file name but performs no ".." path-containment check, so an entry named ../../../../Windows/System32/calc.exe escapes the extraction directory and is passed to cp_open -> ShellExecuteW; the extracting backend (7-Zip) strips the traversal while the opener does not. In addition, the SECEXTCONST dangerous-extension confirmation prompt is implemented only in the double-click handler (grid_obj_open) and not on this preview route, so an executable inside an archive reaches ShellExecuteW unannounced, and where the prompt does fire it names the entry's display name rather than the resolved path that will run. Arbitrary code execution was demonstrated with a proof of concept against official PeaZip builds, confirmed on two archive formats (.zip and .tar) to show the defect is in PeaZip's own path handling and not in a single format parser.5hCVE-2026-50619—
—
———A path traversal vulnerability has been reported to affect Qsirch. If exploited, the vulnerability could allow remote attackers to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsirch 7.0.3.0 and later8hCVE-2026-34015—
—
———A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later8hCVE-2026-26243—
—
———A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.6 and later Qsync Central 5.1.0.2 and later Qsync Central 5.2.0.4 and later8hCVE-2026-41544—
—
———A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QcalAgent 1.1.10 and later10hCVE-2026-24718—
—
———A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.7 and later Qsync Central 5.1.0.3 and later Qsync Central 5.2.0.5 and later Qsync Central 5.3.0.2 and later10h