CVE-2024-13966

Katalog CVE

CVSS 7.3 · High EPSS 0,39%

Kerentanan Use of Default Password pada zkteco biotime. Skor CVSS 3.1 7.3 (High) menurut CNA.

Deskripsi (NVD)

ZKTeco BioTime allows unauthenticated attackers to enumerate usernames and log in as any user with a password unchanged from the default value '123456'. Users should change their passwords (located under the Attendance Settings tab as "Self-Password").

Rincian

Terbit di NVD

27 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.3 (High), sumber CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1393: Use of Default Password

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 30,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.zkteco.com/en/Security_Bulletinsibs/18 advisory vendor
• https://krashconsulting.com/fury-of-fingers-biotime-rce/ advisory pihak ketiga
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-148-01.json advisory pihak ketiga
• https://www.cve.org/CVERecord?id=CVE-2024-13966 advisory pihak ketiga
• https://zkteco-store.ru/wp-content/uploads/2023/09/ZKBio-CVSecurity-6.0.0-User-Manual_EN-v1.0_20230616.pdf product