CVE-2024-11049 - CVE House
Back to Database
Status published Medium CVE-2024-11049

ZKTeco ZKBio Time Image File photo direct request

Vulnerability Description

A vulnerability classified as problematic has been found in ZKTeco ZKBio Time 9.0.1. Affected is an unknown function of the file /auth_files/photo/ of the component Image File Handler. The manipulation leads to direct request. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-11049

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Cybersecurity Center - MOI Iraq (VulDB User)
  • Cybersecurity Center - MOI Iraq (VulDB User)

References

More from ZKTeco

View All →
CVE-2025-45746
In ZKT ZKBio CVSecurity 6.4.1_R an unauthenticated attacker can craft...
Medium 6.5
CVE-2025-15128
ZKTeco BioTime Endpoint safe_setting credentials storage
Medium 6.9
CVE-2024-6523
ZKTeco BioTime system-group-add cross site scripting
Medium 5.3
CVE-2024-6344
ZKTeco ZKBio CVSecurity V5000 Push Configuration Section cross site scripting
Medium 4.8
CVE-2024-6006
ZKTeco ZKBio CVSecurity V5000 Summer Schedule cross site scripting
Medium 5.1

Affected Vendor

Affected Software

ZKBio Time
Vulnerable Versions:
9.0.1

Timeline

Official Publish: November 10th, 2024
Last Modified: November 14th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Weaknesses (CWE)

CWE-425

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.