CVE-2023-3942: Multiple SQLi in ZkTeco-based OEM devices
An 'SQL Injection' vulnerability, due to improper neutralization of special elements used in SQL commands, exists in ZKTeco-based OEM devices. This vulnerability allows an attacker to, in some cases, impersonate another user or perform unauthorized actions. In other instances, it enables the attacker to access user data and system parameters from the database. This issue affects ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others)
with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly other, Standalone service v. 2.1.6-20200907 and possibly others.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-3942?
CVE-2023-3942 has a high severity rating due to its potential for SQL Injection attacks which can lead to user impersonation and unauthorized access.
How do I fix CVE-2023-3942?
To fix CVE-2023-3942, users should apply the latest firmware updates provided by ZKTeco to mitigate the SQL Injection vulnerability.
What devices are affected by CVE-2023-3942?
CVE-2023-3942 affects ZKTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME, and standalone services with specific versions.
What are the potential impacts of CVE-2023-3942?
The potential impacts of CVE-2023-3942 include unauthorized actions and the ability to impersonate other users within the affected systems.
Is there a workaround for CVE-2023-3942 if I cannot update immediately?
As a temporary workaround for CVE-2023-3942, it is advisable to limit access to the affected devices and monitor for unusual activities until the update can be applied.