CVE-2024-22988

Katalog CVE

CVSS 9.8 · Critical EPSS 0,82%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada zkteco zkbio wdms. Skor CVSS 3.1 9.8 (Critical) menurut CISA ADP.

Deskripsi (NVD)

ZKteco ZKBio WDMS before 9.0.2 Build 20250526 allows an attacker to download a database backup via the /files/backup/ component because the filename is based on a predictable timestamp.

Rincian

Terbit di NVD

23 Februari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,82% peluang dieksploitasi; lebih tinggi dari 55,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/whiteman007/b50a9b64007a5d7bcb7a8bee61d2cb47 advisory pihak ketiga
• https://www.vicarius.io/vsociety/posts/revealing-cve-2024-22988-a-unique-dive-into-exploiting-access-control-g... advisory pihak ketiga
• https://www.zkteco.com/en/Security_Bulletinsibs/12
• https://zkteco.com product