CVE-2023-3942

Summary

CVE-2023-3942 is a newly identified SQL Injection vulnerability affecting ZKTeco-based OEM devices, including the ZkTeco ProFace X, Smartec ST-FR043, and Smartec ST-FR041ME. This issue arises due to the failure to neutralize special elements in SQL commands, exposing users to potential unauthorized actions and data access. Affected devices run on firmware ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly others, along with Standalone service v. 2.1.6-20200907 and potentially later versions. Attackers can potentially impersonate other users, access user data, and manipulate system parameters, posing a serious security risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.