CVE-2024-22988

CRITICAL 9.8CVE-2024-22988 · Published 23/02/2024 · updated 17/06/2026

In short

CVE-2024-22988 is a CRITICAL (CVSS 9.8) vulnerability affecting zkbio wdms (zkteco).
Chance of exploitation in the next 30 days (EPSS): 0.81%, higher than 57.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
zkbio wdms zkteco	`= 8.0.5`	No fix yet

Description

ZKteco ZKBio WDMS before 9.0.2 Build 20250526 allows an attacker to download a database backup via the /files/backup/ component because the filename is based on a predictable timestamp.

References

gist.github.com/whiteman007/b50a9b64007a5d7bcb7a8bee61d2cb47 · Third Party Advisory
vicarius.io/vsociety/posts/revealing-cve-2024-22988-a-unique-dive-into-exploiting-access-control-gaps-in-zkbio-wdms-uncover-the-untold-crafted-for-beginners-with-a-rare-glimpse-into-pentesting-strategies · Third Party Advisory
zkteco.com/en/Security_Bulletinsibs/12
zkteco.com · Product

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free