CVE-2023-4587: Insecure direct object reference in ZKTeco ZEM800
Published Sep 4, 2023
·Updated
UNSUPPPORTED WHEN ASSIGNED An IDOR vulnerability has been found in ZKTeco ZEM800 product affecting version 6.60. This vulnerability allows a local attacker to obtain registered user backup files or device configuration files over a local network or through a VPN server.
Affected Software
4 affected components
All of the following
ZKTeco Zem800 Firmware=6.60
ZKTeco ZEM800
ZKTeco Zem800 Firmware=6.60
ZKTeco ZEM800
Remediation
Information
The gama has been updated and it is recommended to upgrade to the latest version available.
Event History
Sep 4, 2023
CVE Published
via MITRE·11:23 AM
Data Sourced
via MITRE·11:23 AM
RemedyDescriptionSeverityWeakness
Unsupported
12:15 PM
Data Sourced
via NVD·12:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2023-4587.
2
What is the severity of CVE-2023-4587?
The severity of CVE-2023-4587 is high with a severity value of 5.5.
3
Which software version of ZKTeco ZEM800 is affected by CVE-2023-4587?
Version 6.60 of ZKTeco ZEM800 firmware is affected by CVE-2023-4587.
4
What can a local attacker do with this vulnerability?
A local attacker can obtain registered user backup files or device configuration files over a local network or through a VPN server.
5
Are there any references available for CVE-2023-4587?
Yes, you can find references for CVE-2023-4587 at https://www.incibe.es/en/incibe-cert/notices/aviso/insecure-direct-object-reference-zkteco-zem800