Vulnerability · Published Jun 15, 2024 · Assigned by VulDB
CVE-2024-6006ZKTeco ZKBio CVSecurity V5000 Summer Schedule cross site scripting
Low 3.5
In plain English
A low-severity cross-site scripting in ZKBio CVSecurity V5000 from ZKTeco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities).
Official description
A vulnerability was found in ZKTeco ZKBio CVSecurity V5000 4.1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Summer Schedule Handler. The manipulation of the argument Schedule Name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor explains, "that ZKBio Security V5000 has been withdrawn from the market and [is] recommended for upgrading to the ZKBio CVSecurity latest version." This vulnerability only affects products that are no longer supported by the maintainer.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ZKTeco | ZKBio CVSecurity V5000 | 4.1.0 |
Weakness: CWE-79, CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
References
- VDB-268694 | ZKTeco ZKBio CVSecurity V5000 Summer Schedule cross site scripting vdb-entry, technical-description
- VDB-268694 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- Submit #351403 | ZKTeco ZKBio CVSecurity 4.1.0 Stored Cross-Site Scripting third-party-advisory