{"id":"CVE-2023-38951","aliases":["EUVD-2023-42711","GHSA-vc5p-9c2v-8jwq"],"status":"published","title":"A path traversal vulnerability in ZKTeco BioTime v8.5.5 allows attackers to write arbitrary files...","description":"ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the server via crafted requests to /base/sftpsetting/ endpoints that abuse a path traversal issue in the Username field and a lack of input sanitization on the SSH Key field. Overwriting specific files may lead to arbitrary code execution as NT AUTHORITY\\SYSTEM.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03257,"percentile":0.8844,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2023-08-03T00:00:00Z","modified":"2026-07-09T01:18:33Z","products":[{"vendor":"zkteco","product":"biotime"}],"references":[{"url":"https://claroty.com/team82/disclosure-dashboard/cve-2023-38951","tags":["x_transferred","Third Party Advisory"]},{"url":"https://github.com/omair2084/biotime-rce-8.5.5/blob/main/biotime_enum.py"},{"url":"https://krashconsulting.com/fury-of-fingers-biotime-rce/"},{"url":"https://www.zkteco.com/en/ZKBio_Time/ZKBioTime#Download"},{"url":"https://www.zkteco.com/en/announcement"},{"url":"https://sploitus.com/exploit?id=PACKETSTORM:177859","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38951"},{"url":"http://zkteco.com"},{"url":"https://krashconsulting.com/fury-of-fingers-biotime-rce"},{"url":"https://github.com/advisories/GHSA-vc5p-9c2v-8jwq"}],"sources":{"cve":[{"id":"CVE-2023-38951","description":"ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the server via crafted requests to /base/sftpsetting/ endpoints that abuse a path traversal issue in the Username field and a lack of input sanitization on the SSH Key field. Overwriting specific files may lead to arbitrary code execution as NT AUTHORITY\\SYSTEM.","status":"published","published":"2023-08-03T00:00:00Z","modified":"2026-07-09T00:27:19.743Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:35:29.772612Z"}],"euvd":[{"id":"EUVD-2023-42711","description":"ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the server via crafted requests to /base/sftpsetting/ endpoints that abuse a path traversal issue in the Username field and a lack of input sanitization on the SSH Key field. Overwriting specific files may lead to arbitrary code execution as NT AUTHORITY\\SYSTEM.","status":"published","published":"2023-08-03T00:00:00Z","modified":"2026-07-09T00:27:19Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:20:05.755223Z"}],"ghsa":[{"id":"GHSA-vc5p-9c2v-8jwq","title":"A path traversal vulnerability in ZKTeco BioTime v8.5.5 allows attackers to write arbitrary files...","description":"A path traversal vulnerability in ZKTeco BioTime v8.5.5 allows attackers to write arbitrary files via using a malicious SFTP configuration.","status":"published","published":"2023-08-04T00:30:16Z","modified":"2025-05-24T15:31:32Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:02:26.348006Z"}],"nvd":[{"id":"CVE-2023-38951","description":"ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the server via crafted requests to /base/sftpsetting/ endpoints that abuse a path traversal issue in the Username field and a lack of input sanitization on the SSH Key field. Overwriting specific files may lead to arbitrary code execution as NT AUTHORITY\\SYSTEM.","status":"published","published":"2023-08-03T23:15:11.363Z","modified":"2026-07-09T01:18:33.267Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:08:20.798312Z"}]}}