Description
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in ZkTeco-based OEM devices allows OS Command Injection. Since all the found command implementations are executed from the superuser, their impact is the maximum possible. This issue affects ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others) with the ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly other.
References (1)
Core 1
Core References
Scores
CVSS v3
10.0
EPSS
0.0101
EPSS Percentile
77.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
total
Details
CWE
CWE-78
Status
published
Products (1)
ZkTeco/ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0
ZAM170-NF-1.8.25-7354-Ver1.0.0
Published
May 21, 2024
Tracked Since
Feb 18, 2026