CVE-2023-38950: ZKTeco BioTime path traversal, unauthenticated file read, in CISA KEV
The short version: ZKTeco BioTime — a biometric time-and-attendance platform — has a path-traversal flaw (CVE-2023-38950) in its iclock API that lets an unauthenticated attacker read arbitrary files off the underlying system. It scores 7.5 and it's in CISA's Known Exploited Vulnerabilities catalog. What leaks — configs, credentials, and sensitive HR/biometric data — is what makes it matter. Patch it, and confirm what was reachable. Steady hands.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Moderate — in practice (it's an unauthenticated leak of whatever the server can read) |
| CVSS v3.1 (NVD) | 7.5 — High · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| EPSS | 84.88% · 99.69th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2025-06-09 |
| Known exploited? | Yes — added to KEV on 2025-05-19 |
| Vulnerability type | CWE-22 path traversal → unauthenticated arbitrary file read |
| Requires authenticated session? | No — pre-authentication |
| Affected | ZKTeco BioTime v8.5.5 |
| Fixed in | ZKBioTime 9.0.120240617.19506 (per NVD/vendor) |
What you need to know
CVE-2023-38950 is a path-traversal (directory-traversal) flaw. By supplying a crafted path — the classic ../../ sequence — to the BioTime iclock API, an unauthenticated attacker escapes the intended directory and reads files elsewhere on the system: configuration, credentials, and the sensitive personnel and biometric records BioTime is built to hold.
It's "only" a read primitive, but the details make it serious:
- It's pre-authentication. Anyone who can reach the interface can pull files — no login, no chain.
- It's a biometric/HR system. The data at stake is exactly the kind you don't want disclosed, and leaked credentials or config often become the next step into something worse.
- It's KEV-listed and easy to automate — high EPSS reflects how routinely it's probed.
How serious we see it
Moderate — in practice, above what "information disclosure" usually implies.
An arbitrary-file-read on an internet-facing system is a skeleton key: it doesn't run code by itself, but it hands over the material — credentials, secrets, session data — that lets an attacker come back through the front door. Add the sensitivity of biometric and HR data and the KEV listing, and 7.5 undersells the practical stakes. The reassuring part: it affects a specific version, a fixed release exists, and exposure is quick to confirm.
Recommendations
Straight from the vendor's guidance and CISA:
- Patch now. Upgrade to the fixed ZKBioTime release (9.0.120240617.19506 or later).
- Rotate what may have leaked. Assume any credentials or secrets readable by the server are exposed — rotate them.
- Hunt. Review access logs for traversal patterns (
../, encoded variants) against the iclock API before your patch date. - Harden exposure. Keep BioTime off the public internet; restrict it to trusted networks or a VPN — a time-clock system rarely needs to face the world.
- Confirm your exposure first. Verify whether you run an affected BioTime version reachable from the internet.
How BreachRisk sees it
BreachRisk discovers internet-facing BioTime interfaces from little more than your domain, fingerprints the product, and flags exposure tied to this KEV-listed vulnerability so it rises to the top of your results. Because BreachBits looks from the outside in, a forgotten time-and-attendance box exposed to the internet surfaces as a ranked finding rather than a blind spot — before its files become someone else's reconnaissance.