Actively exploited vulnerabilities affecting ZKTeco products.https://wildfortech.comhttps://wildfortech.com/security#CVE-2023-38950https://wildfortech.com/security#CVE-2023-38950ZKTeco BioTime, a workforce management and time-attendance platform, contains a path traversal flaw in its iclock API. An unauthenticated attacker — meaning no credentials are required — can craft a malicious request to read arbitrary files on the underlying system. This could expose sensitive configuration files, credentials, or other data, potentially enabling further compromise of the environment without any initial foothold.Mon, 19 May 2025 00:00:00 GMTZKTecoBioTime