CVE-2024-6344
ZKTeco ZKBio CVSecurity V5000 Push Configuration Section cross site scripting
- State
- Published
- Severity
- 4.8 Medium
- Published
- Jun 26, 2024
- Updated
- Jul 10, 2025
- Reserved
- Jun 26, 2024
Description
A vulnerability, which was classified as problematic, was found in ZKTeco ZKBio CVSecurity V5000 4.1.0. This affects an unknown part of the component Push Configuration Section. The manipulation of the argument Configuration Name leads to cross site scripting. It is possible to initiate the attack remotely. It is recommended to upgrade the affected component. The vendor explains, that "[s]ince ZKBio CVSecurity v5000 has been withdrawn from the market, we recommend upgrading to ZKBio CVSecurity V6600 6.1.3_R or above". This vulnerability only affects products that are no longer supported by the maintainer.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 4.8 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 2.4 Low | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C | VulDB |
| 3.0 | 2.4 Low | CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C | VulDB |
| 2.0 | 3.3 Low | AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:OF/RC:C | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
ZKBio CVSecurity V5000ZKTeco |
|
References
- VDB-269733 | ZKTeco ZKBio CVSecurity V5000 Push Configuration Section cross site scriptingvdb-entrytechnical-description
- VDB-269733 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- Submit #358596 | ZKTeco ZKBio CVSecurity V5000 V5000 4.1.0 Stored Cross-Site Scriptingthird-party-advisory
- https://www.zkteco.com/en/Security_Bulletinsibs/17related
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.