High severity7.5NVD Advisory· Published Aug 3, 2023· Updated Jul 9, 2026

CVE-2023-38952

Description

Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not validated for the type of user accessing the application by default. Privilege restrictions between non-admin and admin users are not enforced and any authenticated user can leverage admin functions without restriction by making direct requests to administrative endpoints.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Zkteco/BioTimecpe-rescue2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: <=9.0.1

Patches

Vulnerability mechanics

References

claroty.com/team82/disclosure-dashboard/cve-2023-38952nvdThird Party Advisory
github.com/omair2084/biotime-rce-8.5.5/blob/main/biotime_enum.pynvd
krashconsulting.com/fury-of-fingers-biotime-rce/nvd
sploitus.com/exploitnvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000