VulnerabilityModified

CVE-2024-35428

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via BaseMediaFile.

HIGH 7.1EPSS 0.79%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.79%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via BaseMediaFile. An authenticated user can delete local files from the server which can lead to DoS.

CVSS 3.1: 7.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
EPSS: 0.79% probability · 54th percentile
CISA KEV: Not listed
Weakness: CWE-22
Affected: zkteco/zkbio cvsecurity
Source: cve@mitre.org

References

https://github.com/mrojz/ZKT-Bio-CVSecurity/blob/main/CVE-2024-35428.mdExploit
https://github.com/mrojz/ZKT-Bio-CVSecurity/blob/main/CVE-2024-35428.mdExploit

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.