ZKTeco BioTime Path Traversal (CVE-2023-38950)

Historical catalog analysis: CISA added this entry on May 19, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2023-38950 is a path traversal vulnerability (CWE-22) identified in ZKTeco BioTime. The flaw exists within the iclock API, where an unauthenticated attacker can use a crafted payload to read arbitrary files from the underlying system.

Exposure and applicability

This vulnerability affects organizations deploying ZKTeco BioTime that expose the iclock API to untrusted networks. Because the exploit does not require authentication, any entity with network access to the affected API endpoint could potentially retrieve sensitive system files. Infrastructure owners should identify all instances of BioTime in their environment and determine if the iclock API is reachable from external or unauthorized internal segments.

Remediation priorities

Based on the inclusion of this vulnerability in CISA’s Known Exploited Vulnerabilities catalog, remediation should be prioritized for assets with high exposure. Our analysis suggests the following priority sequence:

1. Vendor Mitigation: Apply the specific mitigations provided by ZKTeco. This is the primary method for reducing the attack surface.
2. Cloud Service Alignment: For organizations utilizing cloud-based deployments, follow BOD 22-01 guidance to ensure service provider compliance and exposure reduction.
3. Decommissioning: If vendor mitigations are unavailable or cannot be applied to a specific legacy version, the product should be discontinued to eliminate the risk.

How to validate remediation

Verification must go beyond checking a version number, as a deployed update does not always guarantee that the configuration is secure or that the fix was successfully initialized. To verify that exposure has been reduced, defenders should:

• Confirm Mitigation Application: Verify through system logs or vendor-provided tools that the specific patch or mitigation for CVE-2023-38950 is active.
• API Access Testing: Use authorized security testing to attempt a file read via the iclock API using known path traversal patterns. A successful remediation should result in the request being blocked or returning an error rather than the requested file content.

Limits and open questions

While the vulnerability allows for arbitrary file reads, it is currently unknown if this flaw has been utilized by ransomware campaigns. Additionally, while CISA has set a remediation deadline of June 9, 2025, for federal agencies, this date serves as a risk indicator rather than a mandatory requirement for private sector organizations. Residual risk remains if the API is left exposed without vendor-supported mitigations, as path traversal can often be used to gather credentials or configuration data necessary for further escalation.

Source and editorial note

CVE-2023-38950: ZKTeco BioTime Path Traversal Vulnerability · Source date: May 19, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: May 22, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 14, 2026 at 00:37 UTC.

Request a Vulnerability Assessment