ZKTeco Biometric System Found Vulnerable to 24 Critical Security Flaws

An analysis of a hybrid biometric access system from Chinese company ZKTeco has uncovered two dozen security flaws that could be made use of by attackers to defeat authentication, steal biometric information, and even deploy malicious backdoors.

“By including random person knowledge to the database or employing a phony QR code, a nefarious actor can conveniently bypass the verification approach and attain unauthorized entry,” Kaspersky claimed. “Attackers can also steal and leak biometric facts, remotely manipulate gadgets, and deploy backdoors.”

The 24 flaws span six SQL injections, 7 stack-centered buffer overflows, 5 command injections, four arbitrary file writes, and two arbitrary file reads. A transient description of each individual vulnerability kind is below –

• CVE-2023-3938 (CVSS score: 4.6) – An SQL injection flaw when exhibiting a QR code into the device’s camera by passing a specifically crafted request containing a quotation mark, thus letting an attacker to authenticate as any person in the database

• CVE-2023-3939 (CVSS score: 10.) – A established of command injection flaws that makes it possible for for execution of arbitrary OS commands with root privileges

• CVE-2023-3940 (CVSS rating: 7.5) – A established of arbitrary file read flaws that enables an attacker to bypass security checks and entry any file on the method, which includes sensitive person info and technique settings

• CVE-2023-3941 (CVSS rating: 10.) – A established of arbitrary file publish flaws that allows an attacker to publish any file on the system with root privileges, together with altering the consumer database to incorporate rogue users

• CVE-2023-3942 (CVSS rating: 7.5) – A established of SQL injection flaws that makes it possible for an attacker to inject malicious SQL code and execute unauthorized database operations and siphon delicate details

• CVE-2023-3943 (CVSS score: 10.) – A established of stack-primarily based buffer overflow flaws that permits an attacker to execute arbitrary code

“The impact of the identified vulnerabilities is alarmingly varied,” security researcher Georgy Kiguradze explained. “To start out with, attackers can promote stolen biometric info on the dark web, subjecting impacted individuals to enhanced threats of deepfake and complex social engineering assaults.”

In addition, successful exploitation of the shortcomings could allow nefarious actors to gain obtain to otherwise restricted zones and even implant backdoors to infiltrate critical networks for cyber espionage or disruptive attacks.

The Russian cybersecurity firm, which determined the flaws following reverse engineering of the firmware (variation ZAM170-NF-1.8.25-7354-Ver1..) and the proprietary protocol utilized to talk with the unit, explained it does not have any visibility into whether these issues have been patched.

To mitigate the risk of assaults, it truly is proposed to shift biometric reader use into a individual network section, use sturdy administrator passwords, strengthen device security options, lessen the use of QR codes, and continue to keep techniques up-to-date.

“Biometric products designed to boost physical security can the two offer convenient, valuable characteristics and introduce new challenges for your IT method,” Kaspersky mentioned.

“When state-of-the-art technology like biometrics is enclosed in a improperly secured gadget, this all but cancels out the advantages of biometric authentication. So, an insufficiently configured terminal results in being susceptible to very simple attacks, generating it uncomplicated for an intruder to violate the physical security of the organization’s critical regions.”

Located this report exciting? Observe us on Twitter  and LinkedIn to study more exclusive content we article.

Some parts of this article are sourced from:
thehackernews.com