CVE-2023-38949

HIGH 7.5CVE-2023-38949 · Published 03/08/2023 · updated 09/07/2026

In short

CVE-2023-38949 is a HIGH (CVSS 7.5) vulnerability affecting biotime (zkteco).
Chance of exploitation in the next 30 days (EPSS): 0.42%, higher than 36.4% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
biotime zkteco	`= 8.5.5`	No fix yet

Description

An issue in a hidden API in ZKTeco BioTime v8.5.5 allows unauthenticated attackers to arbitrarily reset the Administrator password via a crafted web request.

References

claroty.com/team82/disclosure-dashboard/cve-2023-38949 · Third Party Advisory

More vulnerabilities in biotime

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

biotime

zkteco

= 8.5.5

No fix yet

More vulnerabilities in biotime

See all →