CVE-2023-3942

An 'SQL Injection' vulnerability, due to improper neutralization of special elements used in SQL commands, exists in ZKTeco-based OEM devices. This vulnerability allows an attacker to, in some cases, impersonate another user or perform unauthorized actions. In other instances, it enables the attacker to access user data and system parameters from the database. This issue affects ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others) with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly other, Standalone service v. 2.1.6-20200907 and possibly others.

• CWE-89

• https://github.com/klsecservices/Advisories/blob/master/K-ZkTeco-2023-005.md
• https://github.com/klsecservices/Advisories/blob/master/K-ZkTeco-2023-005.md

Published

May 21, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-39414Multiple integer underflow vulnerabilities exist in the LXT2…7.3
• CVE-2023-39415Improper authentication vulnerability in Proself Enterprise/…7.5
• CVE-2023-39416Proself Enterprise/Standard Edition Ver5.61 and earlier, Pro…7.2
• CVE-2023-39417IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was f…8.8
• CVE-2023-39418A vulnerability was found in PostgreSQL with the use of the …4.3
• CVE-2023-39419A vulnerability has been identified in Solid Edge SE2023 (Al…7.8
• CVE-2023-39420The RDPCore.dll component as used in the IRM Next Generation…8.8
• CVE-2023-39421The RDPWin.dll component as used in the IRM Next Generation …7.7
• CVE-2023-39422The /irmdata/api/ endpoints exposed by the IRM Next Generati…9.8
• CVE-2023-39423The RDPData.dll file exposes the /irmdata/api/common endpoin…9.1
• CVE-2023-39424A vulnerability in RDPngFileUpload.dll, as used in the IRM N…8.8
• CVE-2023-39425Improper access control in some Intel(R) DSA software before…7.8