ZKTeco BioTime multiple vulnerabilities
ZKTeco BioTime is a web-based time and attendance management software. A default password vulnerability was found that allows an attacker to log in to any user account that does not change their password. Attackers utilizing this obtain user credentials and can possibly perform actions as an administrative user if able to successfully log in as one. Users should change their passwords (located under the Attendance Settings tab as "Self-Password").
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-13966US | —OT erhöht | — | ||
ZKTeco BioTime allows unauthenticated attackers to enumerate usernames and log in as any user with a password unchanged from the default value '123456'. Users should change their p… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
Behebungen (1)
- WorkaroundBioTime
Change password in the Attendance Settings tab under "Self-Password".
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan