SQL Injection in Zkteco Zkteco-Based Oem Devices With Firmware Zam170-Nf-1.8.25-7354-Ver1.0.0, Standalone Service V. 2.1.6-20200907
CVE-2023-3942
An 'SQL Injection' vulnerability, due to improper neutralization of special elements used in SQL commands, exists in ZKTeco-based OEM devices. This vulnerability allows an attacker to, in some cases, impersonate another user or perform unauthorized actions. In other instances, it enables the attacker to access user data and system parameters from the database. This issue affects ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others) with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly other, Standalone service v. 2.1.6-20200907 and possibly others.
Vulnerability class: SQL Injection
EPSS: 0.006 (44.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Zkteco Zkteco-based Oem Devices With Firmware Zam170-nf-1.8.25-7354-ver1.0.0, Standalone Service V. 2.1.6-20200907 — versions ZAM170-NF-1.8.25-7354-Ver1.0.0, Standalone service v. 2.1.6-20200907
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2023-3942?
- CVE-2023-3942 is a high-severity vulnerability in Zkteco Zkteco-Based Oem Devices With Firmware Zam170-Nf-1.8.25-7354-Ver1.0.0, Standalone Service V. 2.1.6-20200907, classified under SQL Injection. CVSS score: 7.5/10. Published 2024-05-21.
- How severe is CVE-2023-3942?
- High severity. CVSS v3 base score is 7.5 out of 10.