CVE-2023-38950: ZKTeco BioTime iclock API path traversal allows unauthenticated file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with a public exploit, unauthenticated network reachability, and a very high EPSS score, making active exploitation likely.

What it is

The iclock API in ZKTeco BioTime v8.5.5 is vulnerable to path traversal (CWE-22), letting an unauthenticated attacker read arbitrary files by supplying a crafted payload. The flaw was fixed in ZKBioTime version 9.0.120240617.19506. Because the endpoint is reachable over the network without credentials, it exposes sensitive files on internet-facing or internal deployments.

Impact

An attacker can read arbitrary files from the server, which may include configuration data, credentials, or other sensitive material. There is no integrity or availability impact per the CVSS vector; the gain is information disclosure.

Attack surface

Reached over the network via the iclock API (CVSS vector AV:N/AC:L/PR:N/UI:N), so no authentication and no user interaction are required. Any host exposing the BioTime iclock endpoint is a candidate target.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2025-05-19, and a public exploit reference (Packet Storm) exists; EPSS is 0.84702 (99.7th percentile). No ransomware campaign use is documented in the record.

What to do

• Upgrade ZKTeco BioTime to version 9.0.120240617.19506 or later, which contains the fix.
• If immediate patching is not possible, restrict network access to the iclock API to trusted hosts only and remove it from internet exposure.
• Follow CISA KEV required action: apply vendor mitigations, apply BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable.
• Monitor for and block path traversal patterns (e.g., ../ sequences) targeting the iclock endpoint at the web server or WAF layer.
• Rotate any credentials or secrets that may have been stored in files readable through the vulnerable endpoint.

Detection

• Search web/proxy logs for requests to the iclock API containing traversal sequences such as ../, ..%2f, or encoded variants.
• Alert on unusual file-read activity or access to sensitive paths (configuration, credential, or system files) originating from the BioTime service account.
• Monitor for scanning or exploitation attempts against BioTime iclock endpoints from external or untrusted source IPs.
• Review outbound or lateral connections from BioTime hosts that could indicate data exfiltration following file reads.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.