An evaluation of a hybrid biometric entry system from Chinese language producer ZKTeco has uncovered two dozen security flaws that may very well be utilized by attackers to defeat authentication, steal biometric information, and even deploy malicious backdoors.
“By including random person information to the database or utilizing a pretend QR code, a nefarious actor can simply bypass the verification course of and achieve unauthorized entry,” Kaspersky stated. “Attackers can even steal and leak biometric information, remotely manipulate units, and deploy backdoors.”
The 24 flaws span six SQL injections, seven stack-based buffer overflows, 5 command injections, 4 arbitrary file writes, and two arbitrary file reads. A quick description of every vulnerability kind is beneath –
- CVE-2023-3938 (CVSS rating: 4.6) – An SQL injection flaw when displaying a QR code into the machine’s digital camera by passing a specifically crafted request containing a citation mark, thereby permitting an attacker to authenticate as any person within the database
- CVE-2023-3939 (CVSS rating: 10.0) – A set of command injection flaws that enables for execution of arbitrary OS instructions with root privileges
- CVE-2023-3940 (CVSS rating: 7.5) – A set of arbitrary file learn flaws that enables an attacker to bypass security checks and entry any file on the system, together with delicate person information and system settings
- CVE-2023-3941 (CVSS rating: 10.0) – A set of arbitrary file write flaws that enables an attacker to write down any file on the system with root privileges, together with altering the person database so as to add rogue customers
- CVE-2023-3942 (CVSS rating: 7.5) – A set of SQL injection flaws that enables an attacker to inject malicious SQL code and carry out unauthorized database operations and siphon delicate information
- CVE-2023-3943 (CVSS rating: 10.0) – A set of stack-based buffer overflow flaws that enables an attacker to execute arbitrary code
“The affect of the found vulnerabilities is alarmingly numerous,” security researcher Georgy Kiguradze stated. “To start with, attackers can promote stolen biometric information on the darkish net, subjecting affected people to elevated dangers of deepfake and complicated social engineering assaults.”
As well as, profitable exploitation of the shortcomings may allow nefarious actors to achieve entry to in any other case restricted zones and even implant backdoors to infiltrate crucial networks for cyber espionage or disruptive assaults.
The Russian cybersecurity agency, which recognized the failings following reverse engineering of the firmware (model ZAM170-NF-1.8.25-7354-Ver1.0.0) and the proprietary protocol used to speak with the machine, stated it doesn’t have any visibility into whether or not these points have been patched.
To mitigate the chance of assaults, it is really helpful to maneuver biometric reader utilization right into a separate community phase, use sturdy administrator passwords, enhance machine security settings, reduce the usage of QR codes, and hold methods up-to-date.
“Biometric units designed to enhance bodily security can each supply handy, helpful options and introduce new dangers in your IT system,” Kaspersky stated.
“When superior expertise like biometrics is enclosed in a poorly secured machine, this all however cancels out the advantages of biometric authentication. Thus, an insufficiently configured terminal turns into susceptible to easy assaults, making it straightforward for an intruder to violate the bodily security of the group’s crucial areas.”
