CVE-2023-3938

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ZkTeco-based OEM devices allows an attacker to authenticate under any user from the device database.

This issue affects 

ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others) with the ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly others.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
May 21, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2023

CVE-2023-393807.5Permission control vulnerability in the audio module. Successful exploitation of this vulnerability may cause audio devices to perform abnorCVE-2023-393817.5Input verification vulnerability in the storage module. Successful exploitation of this vulnerability may cause the device to restart.CVE-2023-393827.5Input verification vulnerability in the audio module. Successful exploitation of this vulnerability may cause virtual machines (VMs) to restCVE-2023-393837.5Vulnerability of input parameters being not strictly verified in the AMS module. Successful exploitation of this vulnerability may compromisCVE-2023-393847.5Vulnerability of incomplete permission verification in the input method module. Successful exploitation of this vulnerability may cause featCVE-2023-393859.1Vulnerability of configuration defects in the media module of certain products.. Successful exploitation of this vulnerability may cause unaCVE-2023-393867.5Vulnerability of input parameters being not strictly verified in the PMS module. Successful exploitation of this vulnerability may cause newCVE-2023-393875.3Vulnerability of permission control in the window management module. Successful exploitation of this vulnerability may cause malicious pop-uCVE-2023-393887.5Vulnerability of input parameters being not strictly verified in the PMS module. Successful exploitation of this vulnerability may cause homCVE-2023-393897.5Vulnerability of input parameters being not strictly verified in the PMS module. Successful exploitation of this vulnerability may cause homCVE-2023-393910.0Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in ZkTeco-based OEM devices allowsCVE-2023-393907.5Vulnerability of input parameter verification in certain APIs in the window management module. Successful exploitation of this vulnerability
CVE-2023-3938: Medium severity, CVSS 4.6 | Vulnix