HIGH🇵🇱 Wersja polska

CVE-2024-35431

CVSS 7.5v3.1pub. 2024-05-30upd. 2025-06-17

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user can download local files from the server. NOTE: Third parties have indicated other versions are also vulnerable including up to 6.4.1.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

  • Zkteco Zkbio Cvsecurity

    APP
    Zkteco
    6.1.1
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Path Traversal
CWE
References

Related vulnerabilities

CVE-2024-36526CRITICAL9.8PL ✓ten sam produkt

ZKTeco ZKBio CVSecurity — hardcoded klucz kryptograficzny

CVE-2024-35430HIGH8.1ten sam produkt

In ZKTeco ZKBio CVSecurity v6.1.1_R and earlier (fixed in 6.1.3_R) an authenticated user can bypass password c...

CVE-2024-35428HIGH7.1ten sam produkt

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via BaseMediaFile. An authenticated user ca...

CVE-2024-35433HIGH8.1ten sam produkt

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Incorrect Access Control. An authenticated user, without the pe...

CVE-2025-45746MEDIUM6.5ten sam produkt

In ZKT ZKBio CVSecurity 6.4.1_R an unauthenticated attacker can craft JWT token using the hardcoded secret to ...