by Kastro
Paper/Archive/CVE-2023-3943

CVE-2023-3943

ZkTeco ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0 — Multiple buffer overflow in ZkTeco-based OEM devices

EPSS 0.9%CVSS 10.0
critical.is priorityof 100
42
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 61.2.612 × 2012.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Stack-based Buffer Overflow vulnerability in ZkTeco-based OEM devices allows, in some cases, the execution of arbitrary code. Due to the lack of protection mechanisms such as stack canaries and PIE, it is possible to successfully execute code even under restrictive conditions. This issue affects ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others) with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly others.

Affected

ProductAffectedFixed inSource
ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0ZAM170-NF-1.8.25-7354-Ver1.0.0–CNA
facedepot_7b≤ ZAM170-NF-1.8.25-7354-Ver1.0.0–CISA-ADP
smartec_st_fr041me≤ ZAM170-NF-1.8.25-7354-Ver1.0.0–CISA-ADP
smartec_st_fr043≤ ZAM170-NF-1.8.25-7354-Ver1.0.0–CISA-ADP

Scores by source

Kaspersky (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/klsecservices/Advisories/blob/master/K-ZkTeco-2023-006.md