CVE-2024-22988

CRITICO 9.8CVE-2024-22988 · Published 23/02/2024 · updated 17/06/2026

In breve

CVE-2024-22988 è una vulnerabilità CRITICO (CVSS 9.8) che riguarda zkbio wdms (zkteco).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.81%, superiore al 57.1% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
zkbio wdms zkteco	`= 8.0.5`	No fix yet

Description

ZKteco ZKBio WDMS before 9.0.2 Build 20250526 allows an attacker to download a database backup via the /files/backup/ component because the filename is based on a predictable timestamp.

References

gist.github.com/whiteman007/b50a9b64007a5d7bcb7a8bee61d2cb47 · Third Party Advisory
vicarius.io/vsociety/posts/revealing-cve-2024-22988-a-unique-dive-into-exploiting-access-control-gaps-in-zkbio-wdms-uncover-the-untold-crafted-for-beginners-with-a-rare-glimpse-into-pentesting-strategies · Third Party Advisory
zkteco.com/en/Security_Bulletinsibs/12
zkteco.com · Product

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free