CVE-2023-3939

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in ZkTeco-based OEM devices allows OS Command Injection. Since all the found command implementations are executed from the superuser, their impact is the maximum possible. This issue affects ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others) with the ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly other.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
May 21, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2023

CVE-2023-393907.5Vulnerability of input parameter verification in certain APIs in the window management module. Successful exploitation of this vulnerabilityCVE-2023-393917.5Vulnerability of system file information leakage in the USB Service module. Successful exploitation of this vulnerability may affect confideCVE-2023-393927.5Vulnerability of insecure signatures in the OsuLogin module. Successful exploitation of this vulnerability may cause OsuLogin to be maliciouCVE-2023-393937.5Vulnerability of insecure signatures in the ServiceWifiResources module. Successful exploitation of this vulnerability may cause ServiceWifiCVE-2023-393947.5Vulnerability of API privilege escalation in the wifienhance module. Successful exploitation of this vulnerability may cause the arp list toCVE-2023-393957.5Mismatch vulnerability in the serialization process in the communication system. Successful exploitation of this vulnerability may affect avCVE-2023-393967.5Deserialization vulnerability in the input module. Successful exploitation of this vulnerability may affect availability.CVE-2023-393977.5Input parameter verification vulnerability in the communication system. Successful exploitation of this vulnerability may affect availabilitCVE-2023-393989.1Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be reaCVE-2023-393999.1Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be reaCVE-2023-39407.5Relative Path Traversal vulnerability in ZkTeco-based OEM devices allows an attacker to access any file on the system. This issue affectsCVE-2023-394009.1Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be rea
CVE-2023-3939: Critical severity, CVSS 10.0 | Vulnix