CVE-2023-38950: ZKTeco BioTime Path Traversal Vulnerability

CVE-2023-38950 is a path traversal vulnerability in ZKTeco BioTime that affects the iclock API. An unauthenticated attacker can supply a crafted payload to read arbitrary files on the system. This matters because BioTime systems often handle workforce attendance, biometric, and identity data; unauthorized file reads can expose configuration secrets, credentials, or other sensitive material and give an attacker a foothold for further activity. Confirm all product-specific details against the vendor advisory.

How it works

The weakness is classified as CWE-22 (path traversal). In this class of flaw, user-controlled input that is meant to name a file or path is not properly sanitized or constrained. An attacker can insert directory traversal sequences so that the application resolves a path outside the intended directory and returns the contents of an arbitrary file the process can read.

According to the CISA summary, the issue resides in the iclock API of ZKTeco BioTime. An unauthenticated remote attacker supplies a crafted payload that causes the API to read files of the attacker’s choosing. No authentication is required, so the attack surface is any reachable instance of the affected component. Exact request format, payload construction, and file-system privileges depend on the product implementation; treat those as details that must be confirmed against the vendor advisory rather than assumed.

Am I affected? How to find it in your systems

ZKTeco BioTime is typically deployed as an on-premises or appliance-based time-and-attendance / access-control platform, often reachable on internal networks or, less commonly, exposed to the internet for remote clocking. Inventory every host or virtual machine that runs BioTime, including any associated web or API endpoints that implement the iclock interface.

• Search asset inventories, CMDB records, and network scans for “BioTime,” “ZKTeco,” or the product’s known service ports and banners.
• Identify any internet-facing or partner-facing instances of the iclock API; these present the highest immediate risk because the vulnerability requires no authentication.
• Review configuration and version information against the vendor advisory to determine whether a given installation is within the affected range; do not rely on version numbers that are not published in that advisory.
• Examine web-server, application, and API access logs for unusual requests that contain path-traversal sequences (for example, repeated “../” or encoded equivalents) directed at iclock-related endpoints. Sudden spikes in file-read errors or requests for unexpected system paths can be indicators of probing or exploitation.

Because public detail on exact versions and configurations is limited, treat any BioTime deployment that has not been explicitly confirmed as patched as potentially vulnerable until verified.

How to remediate

The primary remediation is to apply the mitigations and updates published by the vendor for ZKTeco BioTime. Follow the vendor’s instructions exactly; CISA’s required action is to apply those mitigations, follow applicable BOD 22-01 guidance if the product is used as a cloud service, or discontinue use if mitigations are unavailable.

• Obtain and install the vendor-supplied fix or configuration change that addresses the path-traversal issue in the iclock API.
• After patching, restart affected services as directed and re-verify that the iclock endpoints no longer accept crafted path payloads.
• As a general hardening step for this class of vulnerability, ensure that any remaining file-access APIs enforce strict path canonicalization, allow-lists of permitted directories, and least-privilege file-system permissions for the service account.
• Remove or restrict any unnecessary exposure of the BioTime management or API interfaces once the patch is confirmed.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls that limit reachability and detect abuse of the path-traversal class.

• Segment BioTime hosts onto isolated network segments; block inbound access to the iclock API from untrusted networks, including the internet, via firewall or security-group rules.
• If a web application firewall or reverse proxy sits in front of the service, enable rules that reject requests containing path-traversal sequences or that target unexpected file paths; treat this as virtual patching only and confirm rule efficacy against the vendor’s description of the flaw.
• Disable or restrict the iclock API feature if operationally feasible and if the vendor documentation permits it.
• Increase logging and monitoring on the BioTime host and any front-end proxies; alert on anomalous file-read attempts, unexpected process file access, or high volumes of 4xx/5xx responses from the API.
• Enforce least-privilege credentials for the BioTime service account so that even a successful read is limited to non-sensitive files.

These measures lower risk but do not eliminate the vulnerability; schedule the official vendor mitigation as soon as possible.

If your data may have been exposed

Actively exploited path-traversal vulnerabilities can lead to unauthorized disclosure of files that contain credentials, configuration data, or personal information, which in turn can enable broader compromise. Known ransomware use of this specific CVE is not documented, but any confirmed exploitation should be treated as a potential data-exposure event. Review logs for evidence of successful arbitrary file reads, rotate any credentials that may have been accessible, and follow your incident-response plan. You can also run a free exposure scan of your email address to check whether it appears in known breach data sets.