FKIE_CVE-2023-3938

Vulnerability from fkie_nvd - Published: 2024-05-21 10:15 - Updated: 2026-06-17 06:15
Severity
4.6 (Medium) - CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ZkTeco-based OEM devices allows an attacker to authenticate under any user from the device database. This issue affects  ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others) with the ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly others.
References
vulnerability@kaspersky.comhttps://github.com/klsecservices/Advisories/blob/master/K-ZkTeco-2023-001.md
af854a3a-2127-422b-91ae-364da2661108https://github.com/klsecservices/Advisories/blob/master/K-ZkTeco-2023-001.md
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unknown",
          "product": "ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0",
          "vendor": "ZkTeco",
          "versions": [
            {
              "status": "affected",
              "version": "ZAM170-NF-1.8.25-7354-Ver1.0.0"
            }
          ]
        }
      ],
      "source": "vulnerability@kaspersky.com"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:h:zkteco:smartec_st_fr043:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "smartec_st_fr043",
          "vendor": "zkteco",
          "versions": [
            {
              "lessThanOrEqual": "ZAM170-NF-1.8.25-7354-Ver1.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:h:zkteco:smartec_st_fr041me:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "smartec_st_fr041me",
          "vendor": "zkteco",
          "versions": [
            {
              "lessThanOrEqual": "ZAM170-NF-1.8.25-7354-Ver1.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:h:zkteco:facedepot_7b:-:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "facedepot_7b",
          "vendor": "zkteco",
          "versions": [
            {
              "lessThanOrEqual": "ZAM170-NF-1.8.25-7354-Ver1.0.0",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL\n Injection\u0027) vulnerability in ZkTeco-based OEM devices allows an \nattacker \n to authenticate under any user from the device database.\n\nThis issue affects\u00a0\n\n\nZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec \nST-FR041ME and possibly others) with the ZAM170-NF-1.8.25-7354-Ver1.0.0 \nand possibly others."
    },
    {
      "lang": "es",
      "value": " La neutralizaci\u00f3n incorrecta de elementos especiales utilizados en una vulnerabilidad de comando SQL (\"inyecci\u00f3n SQL\") en dispositivos OEM basados en ZkTeco permite a un atacante autenticarse con cualquier usuario de la base de datos del dispositivo. Este problema afecta a los dispositivos OEM basados en ZkTeco (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME y posiblemente otros) con ZAM170-NF-1.8.25-7354-Ver1.0.0 y posiblemente otros."
    }
  ],
  "id": "CVE-2023-3938",
  "lastModified": "2026-06-17T06:15:22.883",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "PHYSICAL",
          "availabilityImpact": "NONE",
          "baseScore": 4.6,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 0.9,
        "impactScore": 3.6,
        "source": "vulnerability@kaspersky.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-3938",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-05-21T15:02:22.205077Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-05-21T10:15:08.730",
  "references": [
    {
      "source": "vulnerability@kaspersky.com",
      "url": "https://github.com/klsecservices/Advisories/blob/master/K-ZkTeco-2023-001.md"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://github.com/klsecservices/Advisories/blob/master/K-ZkTeco-2023-001.md"
    }
  ],
  "sourceIdentifier": "vulnerability@kaspersky.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "vulnerability@kaspersky.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.