Critical severity9.8NVD Advisory· Published Aug 3, 2023· Updated Jul 9, 2026

CVE-2023-38951

Description

ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the server via crafted requests to /base/sftpsetting/ endpoints that abuse a path traversal issue in the Username field and a lack of input sanitization on the SSH Key field. Overwriting specific files may lead to arbitrary code execution as NT AUTHORITY\SYSTEM.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Zkteco/BioTimecpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: 8.5.5 through 9.x before 9.0.1 (20240617.19506)
Zkteco/ZKBio Timellm-fuzzy
Range: 8.5.5 through 9.x before 9.0.1 (20240617.19506)

Patches

Vulnerability mechanics

References

claroty.com/team82/disclosure-dashboard/cve-2023-38951nvdThird Party Advisory
github.com/omair2084/biotime-rce-8.5.5/blob/main/biotime_enum.pynvd
krashconsulting.com/fury-of-fingers-biotime-rce/nvd
sploitus.com/exploitnvd
www.zkteco.com/en/ZKBio_Time/ZKBioTimenvd
www.zkteco.com/en/announcementnvd

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.003
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000