ZKTeco ZKBioTime iclock API Path Traversal Arbitrary File Read Vulnerability (CVE-2023-38950) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTZKTeco ZKBioTime v8.5.5 and all versions prior to 9.0.120240617.19506
Unauthenticated remote attackers can read arbitrary sensitive system files by sending a crafted payload to the vulnerable API endpoint
Immediately upgrade to the patched version (9.0.120240617.19506 or higher) and restrict external access to the application
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the official security patch by upgrading ZKBioTime to version 9.0.120240617.19506 or later.
# Stop the ZKBioTime services before applying the update
Stop-Service -Name 'ZKBioTime Service' -Force
# Run the official installer executable to perform the in-place upgrade
# Start-Process -FilePath 'ZKBioTime_Setup.exe' -ArgumentList '/S' -Wait
# Restart the service after successful installation
Start-Service -Name 'ZKBioTime Service'2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, configure a reverse proxy or Web Application Firewall (WAF) to block malicious traversal patterns targeting the iclock endpoint.
# Nginx configuration to block path traversal attempts on the iclock API
server {
listen 80;
server_name biotime.local;
location /iclock/ {
# Block requests containing directory traversal sequences
if ($request_uri ~* '\.\./') {
return 403 'Access Denied: Path Traversal Attempt Blocked';
}
proxy_pass http://127.0.0.1:8081;
}
}3. Log Audit & IoC Verification Commands
Inspect web server access logs and application logs for potential exploitation attempts.
# Search for directory traversal patterns in Linux-based proxy/web server logs
grep -Ei 'iclock.*(\.\./|\.\.\\)' /var/log/nginx/access.log /var/log/apache2/access.log 2>/dev/null
# Search for traversal patterns in Windows-based BioTime application logs
Get-ChildItem -Path 'C:\Program Files\BioTime\logs' -Recurse | Select-String -Pattern 'iclock.*(\.\./|\.\.\\)'Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2023-38950) is a Path Traversal (CWE-22) flaw located within the iclock API endpoint of ZKTeco ZKBioTime. Due to insufficient validation and sanitization of user-supplied input parameters, the application fails to restrict file paths within the intended directory boundaries, allowing directory traversal sequences to be processed.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request to the iclock API. By embedding directory traversal sequences (such as ../ or its URL-encoded equivalents) into the file path parameters, the attacker can escape the web root directory and force the server to read and return arbitrary files from the underlying operating system. This vulnerability is actively exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
3. Infrastructure & Business Impact
Successful exploitation allows unauthorized access to highly sensitive files, including database credentials, configuration files, and system user hashes. This exposure can lead to full system compromise, database breach, and lateral movement within the internal corporate network.
Official Vendor Advisories & References
A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload. This vulnerability was fixed in version 9.0.120240617.19506 of ZKBioTime.
Frequently Asked SecOps Questions (CVE-2023-38950)
FAQQ1. How critical is CVE-2023-38950 and is it actively exploited in the wild?
CVE-2023-38950 is rated CVSS 7.5 (HIGH) with a 30-day EPSS exploitation probability of 92.5%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2023-38950?
Primary impacted vendors include zkteco across biotime, zkbiotime. Scope summary: ZKTeco ZKBioTime v8.5.5 and all versions prior to 9.0.120240617.19506
Q3. What temporary mitigations or workarounds exist for CVE-2023-38950 before patching?
[Mitigation] Immediately upgrade to the patched version (9.0.120240617.19506 or higher) and restrict external access to the application Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2023-38950
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (zkteco)
View Category →Adobe ColdFusion Path Traversal Remote Code Execution Vulnerability Urgent Advisory (CVE-2026-48282)
[Affected Scope] Adobe ColdFusion versions 2025.9, 2023.20 and earlier
WebDyne Perl Framework Path Traversal and Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-78189)
[Affected Scope] Perl web applications utilizing WebDyne versions 3.007 through 3.021
Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.