CVE-2023-38950
ZKTeco BioTime Path Traversal Vulnerability
Description
CVE-2023-38950 is a high-severity path traversal vulnerability in the iclock API of ZKTeco BioTime, a widely deployed workforce management and time attendance platform. The flaw allows unauthenticated attackers to read arbitrary files from the server by supplying a crafted payload to the iclock API endpoint. With a CVSS v3.1 score of 7.5 (HIGH), no authentication or user interaction required, and an EPSS score of 80.79% at the 99.12th percentile indicating near-certain exploitation, CVE-2023-38950 poses a critical risk to organizations using ZKTeco BioTime for employee time tracking and access control management. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 9, 2025.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| zkteco | biotime | < 9.0.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://claroty.com/team82/disclosure-dashboard/cve-2023-38950(Third Party Advisory)
- https://sploitus.com/exploit?id=PACKETSTORM:177859(Exploit)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38950(US Government Resource)
- https://www.fortinet.com/content/dam/fortinet/assets/reports/report-incident-response-middle-east.pdf(Broken Link, Technical Description)
Weakness Type
CWE-22: Path Traversal
CVE-2023-38950 is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), known as path traversal. In ZKTeco BioTime, the iclock API fails to properly validate file path input, allowing attackers to use directory traversal sequences to escape the intended directory and read arbitrary files from the server file system. This enables access to sensitive configuration files, database credentials, and other protected data.
Learn more: CWE-22 — Path Traversal
Impact Analysis
CVE-2023-38950 has high confidentiality impact through unauthenticated arbitrary file read. The vulnerability is network-accessible (AV:N) with low complexity (AC:L), requiring no authentication (PR:N) and no user interaction (UI:N). Confidentiality (High): The path traversal allows reading any file accessible to the web application process, including application configuration files containing database credentials, API keys, and encryption secrets. For a workforce management system like BioTime, this includes employee personal information, biometric data references, access control configurations, and organizational hierarchies. Exposure of database credentials can lead to secondary database compromise. Integrity and Availability are not directly impacted (rated None), as this is a read-only vulnerability. However, the information obtained—particularly database credentials and configuration data—can be leveraged for further attacks that do impact integrity and availability. The EPSS score of 80.79% at the 99.12th percentile indicates massive exploitation activity, consistent with a Fortinet incident response report documenting its exploitation in Middle East incidents.
Exploit Maturity
CVE-2023-38950 exhibits extremely high exploit maturity with near-certain exploitation activity. Public exploit code is available via Sploitus (PACKETSTORM:177859), providing a ready-to-use exploitation tool. CISA has confirmed active exploitation by adding it to the Known Exploited Vulnerabilities catalog. The EPSS score of 80.79% at the 99.12th percentile places this in the top 0.9% of all vulnerabilities by exploitation probability. Fortinet's incident response report on Middle East attacks documents CVE-2023-38950 being used as part of coordinated attack campaigns. The Claroty Team82 advisory provides additional technical analysis from an ICS/OT security research perspective, highlighting the operational technology implications.
Remediation
-
Update ZKTeco BioTime to version 9.0.1 (specifically 9.0.120240617.19506) or later, which contains the fix for the path traversal vulnerability. Verify the update was successfully applied by checking the version number in the BioTime administration interface.
-
Restrict network access to the BioTime iclock API endpoint. Implement firewall rules to limit access to only authorized time clock devices and management workstations. The iclock API should never be directly exposed to the internet or untrusted networks.
-
Rotate all credentials stored in BioTime configuration files, including database passwords, API keys, SMTP credentials, and any integration secrets. Assume these have been compromised if the server was accessible to untrusted networks while running a vulnerable version.
-
Audit the BioTime server for evidence of exploitation and secondary compromise. Check for unauthorized access to the database, exfiltrated employee data, modified access control policies, and signs of lateral movement using credentials obtained through the path traversal.
-
Implement web application firewall (WAF) rules to detect and block path traversal attempts targeting the iclock API. Monitor server access logs for requests containing directory traversal patterns (
../,..\\%5c, encoded traversal sequences) directed at the BioTime application.
Technical Details
CVE-2023-38950 is a path traversal vulnerability in the iclock API of ZKTeco BioTime version 8.5.5. The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N indicates unauthenticated network-accessible exploitation with high confidentiality impact. The iclock API is designed to communicate with ZKTeco time clock hardware devices, handling clock synchronization, attendance records, and device management. The vulnerability exists because the API does not properly validate or sanitize file path parameters in certain API calls, allowing an attacker to inject directory traversal sequences that resolve to files outside the intended directory. By crafting a payload with sequences such as ../../../etc/passwd or platform-appropriate equivalents, an attacker can read arbitrary files from the server. The BioTime application typically runs with elevated privileges to manage system-level operations, which means the path traversal can access files across the entire file system. The fix in version 9.0.120240617.19506 implements proper path canonicalization and validation to prevent traversal attempts.
Frequently Asked Questions
Is CVE-2023-38950 being actively exploited?
Yes. CVE-2023-38950 is massively exploited with an EPSS score of 80.79% at the 99.12th percentile. Public exploit code is available, CISA has confirmed active exploitation, and Fortinet has documented its use in real-world attack campaigns in the Middle East.
What products are affected by CVE-2023-38950?
ZKTeco BioTime versions prior to 9.0.1 are affected. The vulnerability was confirmed in version 8.5.5. BioTime is a workforce management platform used for time attendance tracking and access control.
How do I fix CVE-2023-38950?
Update ZKTeco BioTime to version 9.0.1 or later. Restrict network access to the iclock API, rotate all stored credentials, and conduct a forensic investigation for signs of data exfiltration.
How severe is CVE-2023-38950?
CVE-2023-38950 has a CVSS score of 7.5 (HIGH) with unauthenticated arbitrary file read capability. While the direct impact is limited to confidentiality, exposed credentials and configuration data can enable further attacks. The EPSS score of 80.79% confirms near-certain exploitation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.