An evaluation of a hybrid biometric entry system from Chinese language producer ZKTeco has uncovered two dozen safety flaws that might be utilized by attackers to defeat authentication, steal biometric information, and even deploy malicious backdoors.
“By adding random user data to the database or using a fake QR code, a nefarious actor can easily bypass the verification process and gain unauthorized access,” Kaspersky stated. “Attackers can also steal and leak biometric data, remotely manipulate devices, and deploy backdoors.”
The 24 flaws span six SQL injections, seven stack-based buffer overflows, 5 command injections, 4 arbitrary file writes, and two arbitrary file reads. A quick description of every vulnerability kind is under –
- CVE-2023-3938 (CVSS rating: 4.6) – An SQL injection flaw when displaying a QR code into the system’s digital camera by passing a specifically crafted request containing a citation mark, thereby permitting an attacker to authenticate as any person within the database
- CVE-2023-3939 (CVSS rating: 10.0) – A set of command injection flaws that enables for execution of arbitrary OS instructions with root privileges
- CVE-2023-3940 (CVSS rating: 7.5) – A set of arbitrary file learn flaws that enables an attacker to bypass safety checks and entry any file on the system, together with delicate person information and system settings
- CVE-2023-3941 (CVSS rating: 10.0) – A set of arbitrary file write flaws that enables an attacker to jot down any file on the system with root privileges, together with altering the person database so as to add rogue customers
- CVE-2023-3942 (CVSS rating: 7.5) – A set of SQL injection flaws that enables an attacker to inject malicious SQL code and carry out unauthorized database operations and siphon delicate information
- CVE-2023-3943 (CVSS rating: 10.0) – A set of stack-based buffer overflow flaws that enables an attacker to execute arbitrary code
“The impact of the discovered vulnerabilities is alarmingly diverse,” safety researcher Georgy Kiguradze stated. “To begin with, attackers can sell stolen biometric data on the dark web, subjecting affected individuals to increased risks of deepfake and sophisticated social engineering attacks.”
As well as, profitable exploitation of the shortcomings might allow nefarious actors to achieve entry to in any other case restricted zones and even implant backdoors to infiltrate crucial networks for cyber espionage or disruptive assaults.
The Russian cybersecurity agency, which recognized the failings following reverse engineering of the firmware (model ZAM170-NF-1.8.25-7354-Ver1.0.0) and the proprietary protocol used to speak with the system, stated it doesn’t have any visibility into whether or not these points have been patched.
To mitigate the chance of assaults, it is really helpful to maneuver biometric reader utilization right into a separate community phase, use sturdy administrator passwords, enhance system safety settings, decrease using QR codes, and hold programs up-to-date.
“Biometric devices designed to improve physical security can both offer convenient, useful features and introduce new risks for your IT system,” Kaspersky stated.
“When advanced technology like biometrics is enclosed in a poorly secured device, this all but cancels out the benefits of biometric authentication. Thus, an insufficiently configured terminal becomes vulnerable to simple attacks, making it easy for an intruder to violate the physical security of the organization’s critical areas.”
