Security readout for executives and security teams
Plain-English summary
ZKTeco BioTime through 9.0.1 is reported to let a logged-in non-admin user reach administrative functions directly. That means a normal account could act beyond its assigned role if the application is exposed and access controls are not enforced. The source bundle does not prove active exploitation, but public exploit-related references increase urgency.
Executive priority
Treat this as high priority for any BioTime deployment because it can undermine role separation. Public exploit-related material exists, and a normal account may be enough to reach admin functions. Prioritize inventory, access restriction, vendor guidance review, and log inspection.
Technical view
The issue is insecure access control in BioTime through 9.0.1. Session IDs are reportedly not validated against the user type by default, so role restrictions between non-admin and admin users can be bypassed through direct requests to administrative endpoints. The bundle’s CVSS vector lists PR:N, while the description says authenticated access is required.
Likely exposure
Organizations using ZKTeco BioTime through 9.0.1, especially systems reachable from the internet or broad internal networks with non-admin user accounts.
Exploitation context
The CVE is not listed as KEV in the bundle. Public exploit-related references are cited, including Packet Storm/Sploitus and GitHub material, but the provided sources do not establish active exploitation in the wild.
Researcher notes
Evidence supports an authenticated authorization bypass affecting BioTime through 9.0.1. The affected CPE data is incomplete in the bundle. Note the mismatch between the narrative requiring authentication and the CVSS vector showing PR:N. Avoid assuming a patch version unless vendor guidance confirms one.
Mitigation direction
- Identify all ZKTeco BioTime deployments and versions.
- Check vendor guidance for fixed versions or official mitigations.
- Restrict BioTime access to trusted networks or VPN users.
- Review and remove unnecessary user accounts.
- Monitor administrative actions from non-admin accounts.
- Disable or firewall exposed administrative interfaces where possible.
Validation and detection
- Confirm whether BioTime version is 9.0.1 or earlier.
- Verify role enforcement using controlled non-admin test accounts.
- Review logs for non-admin access to admin functions.
- Check whether BioTime is internet-accessible.
- Confirm compensating controls restrict administrative endpoint access.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-552: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-38952 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://claroty.com/team82/disclosure-dashboard/cve-2023-38952CVE reference, mitre
- https://github.com/omair2084/biotime-rce-8.5.5/blob/main/biotime_enum.pyCVE reference, mitre
- https://krashconsulting.com/fury-of-fingers-biotime-rce/CVE reference, mitre
- https://sploitus.com/exploit?id=PACKETSTORM:177859CVE reference, CISA-ADP · exploit
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Files or Directories Accessible to External Parties
Files or Directories Accessible to External Parties represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.