CVE-2023-3938 - OpenCVE

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ZkTeco-based OEM devices allows an attacker to authenticate under any user from the device database. This issue affects ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others) with the ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly others.

Attack Vector Physical

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

No data.

No data.

References

Link	Resource
https://github.com/klsecservices/Advisories/blob/master/K-ZkTeco-2023-001.md

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: Kaspersky

Published: 2024-05-21T09:32:15.305Z

Updated: 2024-06-18T18:12:06.498Z

Reserved: 2023-07-25T13:42:20.770Z

Link: CVE-2023-3938

JSON object: View

NVD Information

Status : Awaiting Analysis

Published: 2024-05-21T10:15:08.730

Modified: 2024-05-21T12:37:59.687

Link: CVE-2023-3938

JSON object: View

Redhat Information

No data.

CWE

CWE-89

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-3938", "assignerOrgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988", "state": "PUBLISHED", "assignerShortName": "Kaspersky", "dateReserved": "2023-07-25T13:42:20.770Z", "datePublished": "2024-05-21T09:32:15.305Z", "dateUpdated": "2024-06-18T18:12:06.498Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "product": "ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0", "vendor": "ZkTeco", "versions": [{"status": "affected", "version": "ZAM170-NF-1.8.25-7354-Ver1.0.0"}]}], "credits": [{"lang": "en", "type": "finder", "value": "The vulnerability was discovered by Alexander Zaytsev from Kaspersky"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\nImproper Neutralization of Special Elements used in an SQL Command ('SQL\n Injection') vulnerability in ZkTeco-based OEM devices allows an \nattacker \n to authenticate under any user from the device database.\n\nThis issue affects \n\n\nZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec \nST-FR041ME and possibly others) with the ZAM170-NF-1.8.25-7354-Ver1.0.0 \nand possibly others.\n\n"}], "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL\n Injection') vulnerability in ZkTeco-based OEM devices allows an \nattacker \n to authenticate under any user from the device database.\n\nThis issue affects\u00a0\n\n\nZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec \nST-FR041ME and possibly others) with the ZAM170-NF-1.8.25-7354-Ver1.0.0 \nand possibly others."}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "NONE", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "e45d732a-8f6b-4b6b-be76-7420f6a2b988", "shortName": "Kaspersky", "dateUpdated": "2024-05-21T10:14:30.409Z"}, "references": [{"url": "https://github.com/klsecservices/Advisories/blob/master/K-ZkTeco-2023-001.md"}], "source": {"discovery": "UNKNOWN"}, "timeline": [{"lang": "en", "time": "2023-04-04T21:00:00.000Z", "value": "Vulnerability discovered."}, {"lang": "en", "time": "2023-09-19T14:00:00.000Z", "value": "Initial request to PSIRT@zkteco.com."}, {"lang": "en", "time": "2023-10-03T13:18:00.000Z", "value": "Follow-up with PSIRT@zkteco.com due to no initial response."}, {"lang": "en", "time": "2023-12-20T10:46:00.000Z", "value": "Vulnerability reported to PSIRT@zkteco.com in plaintext."}, {"lang": "en", "time": "2024-05-21T09:31:00.000Z", "value": "No response from vendor; CVE details added to CVE.org."}], "title": "Bypassing ZkTeco-based OEM devices/ZKTeco biometric authentication system via SQLi in QR code", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "zkteco", "product": "smartec_st_fr043", "cpes": ["cpe:2.3:h:zkteco:smartec_st_fr043:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "ZAM170-NF-1.8.25-7354-Ver1.0.0", "versionType": "custom"}]}, {"vendor": "zkteco", "product": "smartec_st_fr041me", "cpes": ["cpe:2.3:h:zkteco:smartec_st_fr041me:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "ZAM170-NF-1.8.25-7354-Ver1.0.0", "versionType": "custom"}]}, {"vendor": "zkteco", "product": "facedepot_7b", "cpes": ["cpe:2.3:h:zkteco:facedepot_7b:-:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "ZAM170-NF-1.8.25-7354-Ver1.0.0", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-05-21T15:02:22.205077Z", "id": "CVE-2023-3938", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-18T18:12:06.498Z"}}]}}