Path Traversal in ZKTeco BioTime (CVE‑2023‑38950) Enables Unauthenticated File Read
What It Is – ZKTeco BioTime’s iclock API contains a path‑traversal flaw that lets an unauthenticated attacker request arbitrary files on the server by supplying a crafted payload.
Exploitability – The vulnerability is publicly disclosed, has an assigned CVSS v3.1 base score of 7.5 (High), and no public exploit code has been released, but the attack requires only network access to the API endpoint.
Affected Products – ZKTeco BioTime (all versions prior to the vendor‑issued patch).
Why It Matters for Trust & Control Assurance
- Control Objective – Application Access Controls: Unauthenticated file reads indicate a missing safeguard around API input validation and file‑system permissions.
- Continuous Monitoring: Organizations that rely on BioTime must demonstrate they are tracking vendor patches and can prove timely remediation.
- Audit‑Ready Evidence: Evidence of patch deployment and updated vendor risk assessments provides a defensible audit trail for regulators and enterprise buyers.
Recommended Actions
- Verify the BioTime version in use and apply the vendor‑released patch immediately.
- Conduct a focused scan of the
iclockendpoint to confirm the vulnerability is mitigated. - Update your third‑party risk register to reflect the new finding and schedule regular re‑assessment of ZKTeco’s security posture.
- Harden API gateways and file‑system permissions to enforce least‑privilege access.
Source: CISA KEV – CVE‑2023‑38950