Vulnerability · Published May 21, 2024 · Assigned by Kaspersky
CVE-2023-3943Multiple buffer overflow in ZkTeco-based OEM devices
Critical 10.0
In plain English
A critical-severity stack buffer overflow in ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0 from ZkTeco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).
Official description
Stack-based Buffer Overflow vulnerability in ZkTeco-based OEM devices allows, in some cases, the execution of arbitrary code. Due to the lack of protection mechanisms such as stack canaries and PIE, it is possible to successfully execute code even under restrictive conditions. This issue affects ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others) with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly others.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ZkTeco | ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0 | ZAM170-NF-1.8.25-7354-Ver1.0.0 |
Weakness: CWE-121 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H