CVE-2023-38950: ZKTeco BioTime Unauthenticated Path Traversal

CVE-2023-38950 is an unauthenticated path-traversal flaw in the iclock API of ZKTeco BioTime, a biometric time-and-attendance and access-control platform, that lets a remote attacker with no credentials read arbitrary files off the server, and CISA's KEV listing confirms it is being actively exploited — notably as the reconnaissance half of a chain with the related file-write bug CVE-2023-38951 that can escalate to full remote code execution.

CVE-2023-38950 affects ZKTeco BioTime, a biometric (fingerprint/face) time-and-attendance and physical access-control platform deployed by employers and facility operators worldwide. NVD's description: "A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload. This vulnerability was fixed in version 9.0.120240617.19506 of ZKBioTime" (NVD).

Both NVD's own Primary analysis and the CISA-coordinated Secondary submission agree on CVSS v3.1 7.5 (HIGH), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N — network-reachable, low complexity, no authentication or user interaction, with high confidentiality impact only (arbitrary file read) and no direct integrity or availability impact (NVD).

ZKTeco's own security bulletin (published 2025-05-12, covering this CVE together with the related CVE-2023-38951) confirms BioTime v8.5.5 and earlier are affected, that the flaw lets an attacker "access system files, potentially leading to data leakage," and directs customers to mainstream fix ZKBioTime 9.0.1 (build 20240617.19506) or, for Middle East-region deployments, build 8.5.5.2944 (ZKTeco Security Bulletin). Security researchers have documented that CVE-2023-38950 is frequently chained with CVE-2023-38951 — an authenticated path-traversal/arbitrary-file-write flaw in BioTime's SFTP-settings endpoint — to escalate from unauthenticated file read to full remote code execution as NT AUTHORITY\SYSTEM on the underlying Windows host.

CISA added CVE-2023-38950 to the Known Exploited Vulnerabilities (KEV) catalog with a due date of 2025-06-09, and Claroty's Team82 research group, which disclosed the issue, maintains a public technical write-up of the flaw (CISA KEV; Claroty Team82 disclosure).

As of 2026-10-30, FIRST scores the probability of exploitation at 0.92468 (99.825th percentile) — an exceptionally high figure that reflects sustained scanning and exploitation of internet-exposed BioTime servers, which attackers have used to pivot toward employee biometric and attendance data as well as, via the companion write bug, full host compromise (FIRST EPSS). Operators should upgrade to the fixed ZKBioTime builds immediately, keep the BioTime management interface off the public internet, and audit for signs of prior file access given the confirmed active exploitation.

• Unauthenticated path traversal in the iclock API of ZKTeco BioTime v8.5.5 and earlier allows arbitrary file read via a crafted payload; fixed in ZKBioTime 9.0.120240617.19506. — NVD
• CVSS v3.1 base score is 7.5 (HIGH), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, agreed by both NVD's own Primary analysis and the CISA-coordinated Secondary submission. — NVD
• ZKTeco's security bulletin confirms BioTime v8.5.5 and earlier affected, describes data-leakage impact, and directs to fixed builds 9.0.1 (20240617.19506) mainstream or 8.5.5.2944 for Middle East deployments. — ZKTeco Security Bulletin
• Added to the CISA Known Exploited Vulnerabilities catalog, due date 2025-06-09; disclosed and documented by Claroty Team82. — CISA KEV
• EPSS score is 0.92468 (99.825th percentile) as of 2026-10-30. — FIRST EPSS