CVE-2024-35431

Summary

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user can download local files from the server. NOTE: Third parties have indicated other versions are also vulnerable including up to 6.4.1.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: yes
  • Technical Impact: partial

CVE Program Container

Additional References

• https://github.com/mrojz/ZKT-Bio-CVSecurity/blob/main/CVE-2024-35431.md

References

• https://github.com/mrojz/ZKT-Bio-CVSecurity/blob/main/CVE-2024-35431.md

• ←Previous
• Next→