CVE-2023-3943 - CVE House
Back to Database
Status published Critical CVE-2023-3943

Multiple buffer overflow in ZkTeco-based OEM devices

Vulnerability Description

Stack-based Buffer Overflow vulnerability in ZkTeco-based OEM devices allows, in some cases, the execution of arbitrary code. Due to the lack of protection mechanisms such as stack canaries and PIE, it is possible to successfully execute code even under restrictive conditions. This issue affects ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others) with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly others.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-3943

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • The vulnerability was discovered by Georgy Kiguradze from Kaspersky

References

More from ZkTeco

View All →
CVE-2023-3942
Multiple SQLi in ZkTeco-based OEM devices
High 7.5
CVE-2023-3941
Multiple arbitrary file writes in ZkTeco-based OEM devices
Critical 10
CVE-2023-3940
Multiple arbitrary file reads in ZkTeco-based OEM devices
High 7.5
CVE-2023-3939
Multiple command injection in ZkTeco-based OEM devices
Critical 10
CVE-2023-3938
Bypassing ZkTeco-based OEM devices/ZKTeco biometric authentication system via SQLi in QR code
Medium 4.6

Affected Vendor

Affected Software

ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0
Vulnerable Versions:
ZAM170-NF-1.8.25-7354-Ver1.0.0

Timeline

Official Publish: May 21st, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-121

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1055 Process Injection
Defense Evasion
T1105 Ingress Tool Transfer
Command and Control
T1485 Data Destruction
Impact