An evaluation of a hybrid biometric entry system from Chinese language producer ZKTeco has uncovered two dozen security flaws that may very well be utilized by attackers to defeat authentication, steal biometric knowledge, and even deploy malicious backdoors.
“By including random person knowledge to the database or utilizing a faux QR code, a nefarious actor can simply bypass the verification course of and acquire unauthorized entry,” Kaspersky stated. “Attackers can even steal and leak biometric knowledge, remotely manipulate units, and deploy backdoors.”
The 24 flaws span six SQL injections, seven stack-based buffer overflows, 5 command injections, 4 arbitrary file writes, and two arbitrary file reads. A quick description of every vulnerability sort is under –
- CVE-2023-3938 (CVSS rating: 4.6) – An SQL injection flaw when displaying a QR code into the gadget’s digital camera by passing a specifically crafted request containing a citation mark, thereby permitting an attacker to authenticate as any person within the database
- CVE-2023-3939 (CVSS rating: 10.0) – A set of command injection flaws that enables for execution of arbitrary OS instructions with root privileges
- CVE-2023-3940 (CVSS rating: 7.5) – A set of arbitrary file learn flaws that enables an attacker to bypass security checks and entry any file on the system, together with delicate person knowledge and system settings
- CVE-2023-3941 (CVSS rating: 10.0) – A set of arbitrary file write flaws that enables an attacker to put in writing any file on the system with root privileges, together with altering the person database so as to add rogue customers
- CVE-2023-3942 (CVSS rating: 7.5) – A set of SQL injection flaws that enables an attacker to inject malicious SQL code and carry out unauthorized database operations and siphon delicate knowledge
- CVE-2023-3943 (CVSS rating: 10.0) – A set of stack-based buffer overflow flaws that enables an attacker to execute arbitrary code
“The influence of the found vulnerabilities is alarmingly various,” security researcher Georgy Kiguradze stated. “To start with, attackers can promote stolen biometric knowledge on the darkish net, subjecting affected people to elevated dangers of deepfake and complex social engineering assaults.”
As well as, profitable exploitation of the shortcomings may allow nefarious actors to achieve entry to in any other case restricted zones and even implant backdoors to infiltrate essential networks for cyber espionage or disruptive assaults.
The Russian cybersecurity agency, which recognized the failings following reverse engineering of the firmware (model ZAM170-NF-1.8.25-7354-Ver1.0.0) and the proprietary protocol used to speak with the gadget, stated it doesn’t have any visibility into whether or not these points have been patched.
To mitigate the danger of assaults, it is really helpful to maneuver biometric reader utilization right into a separate community phase, use sturdy administrator passwords, enhance gadget security settings, reduce using QR codes, and maintain techniques up-to-date.
“Biometric units designed to enhance bodily security can each supply handy, helpful options and introduce new dangers on your IT system,” Kaspersky stated.
“When superior expertise like biometrics is enclosed in a poorly secured gadget, this all however cancels out the advantages of biometric authentication. Thus, an insufficiently configured terminal turns into weak to easy assaults, making it simple for an intruder to violate the bodily security of the group’s essential areas.”
