CVE-2023-38950: ZKTeco BioTime exploited

Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.

What it is

A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload. This vulnerability was fixed in version 9.0.120240617.19506 of ZKBioTime.

Description quoted from the CVE record (assigned by mitre, published 2023-08-03).

Weakness: CWE-22 Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)

How it can be exploited

Exploitable over the network with low attack complexity needing no privileges and no user interaction. Impact: confidentiality high, integrity none, availability none. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA assessment (SSVC): CISA assesses exploitation as active. Automatable: yes. Technical impact: partial.

On CISA KEV since: 2025-05-19
US federal deadline: 2025-06-09
Ransomware use: Not known

Public exploit evidence (Exploit Observer)

Also known as: BDU:2023-04430, CNNVD-202308-260, EUVD-2023-42710, GHSA-27mv-5vpc-8g53

VEDAS cluster: VEDAS:FISSIONFIREFLY

Exploit Observer links 6 pieces of public exploit code or detection modules that name this CVE or one of its aliases.

Exploit code and modules (6)

Code that names this CVE. A repository can be a working exploit, a scanner, a fake or malware; read it before running anything.

Research and write-ups (1)

Research or write-up: https://claroty.com/team82/disclosure-dashboard/cve-2023-38950

Vulnerability databases and vendor advisories (5)

Catalogue entries, not exploit evidence.

Vulnerability database or vendor advisory: https://euvd.enisa.europa.eu/enisa/EUVD-2023-42710
Vulnerability database or vendor advisory: https://github.com/advisories/GHSA-27mv-5vpc-8g53
Vulnerability database or vendor advisory: https://nvd.nist.gov/vuln/detail/CVE-2023-38950
Vulnerability database or vendor advisory: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38950
Vulnerability database or vendor advisory: https://www.cnnvd.org.cn/home/globalSearch?keyword=CNNVD-202308-260

13 more references returned by Exploit Observer did not name this CVE or an alias, so they are left out.

VEDAS data as of 2026-11-01T17:12 UTC; fetched 2026-11-02.

Live scores

EPSS: 0.925
very likely to be attacked soon
VEDAS: 0.978
strong exploit evidence
On CISA KEV: Yes, since 2025-05-19
Detection rule: Nuclei · Suricata

EPSS (chance of attack)

VEDAS (exploit evidence)

Thin horizontal line: the “likely” (EPSS 0.10) or “strong” (VEDAS 0.90) threshold. Shaded “no data” areas are periods when cve-scores did not publish. The vertical line is the day CISA added it to its exploited list.

Who is affected

Product	Affected	Not affected
Not stated	version n/a	Not stated

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

How to fix it

CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Vendor guidance:

How to detect it

Nuclei template (active check)

ZKTeco BioTime - Path Traversal
A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload. This vulnerability was fixed in version 9.0.120240617.19506 of ZKBioTime.

Name and description quoted from the template, written by VEDAS.

The template sends 1 request (GET /iclock/file?url=/../../../../../../../../../windows/win.ini); it decides using dsl matchers. Severity in the template: high. Marked as not yet verified against a live vulnerable target.

Run it against a host you own or are authorised to test:

bash

nuclei -u https://your-host -t CVE-2023-38950.yaml

Show the template (34 lines)

yaml

id: CVE-2023-38950

info:
  name: "ZKTeco BioTime - Path Traversal"
  author: vedas-arpsyndicate
  severity: high
  description: |
    A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to
    read arbitrary files via supplying a crafted payload. This vulnerability was fixed in version
    9.0.120240617.19506 of ZKBioTime.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2023-38950&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=zkteco&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-38950
    cwe-id: CWE-22
  metadata:
    verified: false
  tags: cve,cve2023,zkteco,biotime,lfr,kev,vkev,vuln
http:
  - raw:
      - |
        GET /iclock/file?url=/../../../../../../../../../windows/win.ini HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(header, "text/plain")'
          - 'contains_all(base64_decode(body), "; for 16-bit app support" ,"[extensions]")'
        condition: and

CVE-2023-38950.yaml on GitHub

Suricata rules (network detection)

1 rule that alert on traffic matching this exploit: VEDAS CVE-2023-38950 ZKTeco BioTime - Path Traversal. Add them to your Suricata rule set and reload.

Show the rules

suricata

alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2023-38950 ZKTeco BioTime - Path Traversal"; flow:established,to_server; http.uri; content:"iclock"; nocase; fast_pattern; content:".."; nocase; classtype:web-application-attack; reference:cve,CVE-2023-38950; reference:url,https://www.exploit.observer/?keyword=CVE-2023-38950&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=zkteco&match=exact; sid:1009878; rev:1;)

CVE-2023-38950.rules on GitHub

References

Exploits and technical analysis

https://sploitus.com/exploit?id=PACKETSTORM:177859 (exploit)

Government sources

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-38950 (government-resource)

Other references

Other databases

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, CISA KEV, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.