CVE-2024-35428

HIGH

ZKTeco ZKBio CVSecurity 6.1.1 - Authenticated Path Traversal and Denial of Service via BaseMediaFile

Title source: llm
STIX 2.1

Description

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via BaseMediaFile. An authenticated user can delete local files from the server which can lead to DoS.

References (1)

Core 1

Scores

CVSS v3 7.1
EPSS 0.0079
EPSS Percentile 51.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-22
Status published
Products (1)
zkteco/zkbio_cvsecurity 6.1.1
Published May 30, 2024
Tracked Since Feb 18, 2026