CVE-2023-3940

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Relative Path Traversal vulnerability in ZkTeco-based OEM devices allows an attacker to access any file on the system.

This issue affects ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others) with the ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly others.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-23

Affected software

No affected versions have been published.

Timeline

Published
May 21, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2023

CVE-2023-394009.1Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be reaCVE-2023-394019.1Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be reaCVE-2023-394029.1Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be reaCVE-2023-394039.1Parameter verification vulnerability in the installd module. Successful exploitation of this vulnerability may cause sandbox files to be reaCVE-2023-394047.5Vulnerability of input parameter verification in certain APIs in the window management module. Successful exploitation of this vulnerabilityCVE-2023-394059.8Vulnerability of out-of-bounds parameter read/write in the Wi-Fi module. Successful exploitation of this vulnerability may cause other apps CVE-2023-394067.5Permission control vulnerability in the XLayout component. Successful exploitation of this vulnerability may cause apps to forcibly restart.CVE-2023-394079.1The Watchkit has a risk of unauthorized file access.Successful exploitation of this vulnerability may affect confidentiality and integrity.CVE-2023-394087.5DoS vulnerability in the PMS module. Successful exploitation of this vulnerability may cause the system to restart.CVE-2023-394097.5DoS vulnerability in the PMS module. Successful exploitation of this vulnerability may cause the system to restart.CVE-2023-394110.0Relative Path Traversal vulnerability in ZkTeco-based OEM devices allows an attacker to write any file on the system with root privileges.CVE-2023-394107.5When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead t
CVE-2023-3940: High severity, CVSS 7.5 | Vulnix