Riskcovery

CVE-2024-1706

ZKTeco ZKBio Access IVS Department Name Search Bar cross site scripting

State
Published
Severity
5.1 Medium
Published
Feb 21, 2024
Updated
Aug 22, 2025
Reserved
Feb 21, 2024

Read the record on cve.org

Description

A vulnerability was determined in ZKTeco ZKBio Access IVS up to 3.3.2. This impacts an unknown function of the component Department Name Search Bar. This manipulation with the input <marquee>hi causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor explains: "ZKBio Access IVS is no longer maintained and the product has been replaced by ZKBio CVAccess, it is recommended to replace it with the latest version of ZKBio CVAccess." This vulnerability only affects products that are no longer supported by the maintainer.

Scores

CVSSScoreVectorSource
4.05.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:PVulDB
3.13.5 LowCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:RVulDB
3.03.5 LowCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:RVulDB
2.04.0 MediumAV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:URVulDB

Weaknesses

Affected Products

ProductVersions
ZKBio Access IVSZKTeco
  • 3.3.0Affected
  • 3.3.1Affected
  • 3.3.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.