CVE-2023-3943
Last modified
CVE-2023-3943 is a critical-severity vulnerability rated 10/10 on the CVSS scale. Stack-based Buffer Overflow vulnerability in ZkTeco-based OEM devices allows, in some cases, the execution of arbitrary code. Due to the lack of protection mechanisms such as stack canaries and PIE, it is possible to successfully execute code even under restrictive conditions. This issue affects ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others) with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly others.. EPSS estimates a 0.95% chance of exploitation in the next 30 days.
Description
Stack-based Buffer Overflow vulnerability in ZkTeco-based OEM devices allows, in some cases, the execution of arbitrary code. Due to the lack of protection mechanisms such as stack canaries and PIE, it is possible to successfully execute code even under restrictive conditions. This issue affects ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others) with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly others.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2023-3943?
How severe is CVE-2023-3943?
How do I fix CVE-2023-3943?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-39422The /irmdata/api/ endpoints exposed by the IRM Next Generati…9.8
- CVE-2023-39423The RDPData.dll file exposes the /irmdata/api/common endpoin…9.1
- CVE-2023-39424A vulnerability in RDPngFileUpload.dll, as used in the IRM N…8.8
- CVE-2023-39425Improper access control in some Intel(R) DSA software before…7.8
- CVE-2023-39427 In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt …7.8
- CVE-2023-39429Cross-site scripting vulnerability in FURUNO SYSTEMS wireles…5.4
- CVE-2023-39431 Sante DICOM Viewer Pro lacks proper validation of user-su…7.8
- CVE-2023-39432Improper access control element in some Intel(R) Ethernet to…7.8
- CVE-2023-39433Improper access control for some Intel(R) CST software befor…4.4
- CVE-2023-39434A use-after-free issue was addressed with improved memory ma…8.8
- CVE-2023-39435Zavio CF7500, CF7300, CF7201, CF7501, CB3211, CB3212, CB5220…9.8
- CVE-2023-39436SAP Supplier Relationship Management -versions 600, 602, 603…5.8
Are you affected by CVE-2023-3943?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST