ZKTeco BioTime multiple vulnerabilities
ZKTeco BioTime is a web-based time and attendance management software. A default password vulnerability was found that allows an attacker to log in to any user account that does not change their password. Attackers utilizing this obtain user credentials and can possibly perform actions as an administrative user if able to successfully log in as one. Users should change their passwords (located under the Attendance Settings tab as "Self-Password").
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-13966US | —OT elevated | — | ||
ZKTeco BioTime allows unauthenticated attackers to enumerate usernames and log in as any user with a password unchanged from the default value '123456'. Users should change their p… | ||||
references
External citations — patches, advisories, analysis.
remediations (1)
- WorkaroundBioTime
Change password in the Attendance Settings tab under "Self-Password".
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan