What’s Vulnerable › Vulnerabilities

CVE-2023-3943: Multiple buffer overflow in ZkTeco-based OEM devices

• Severity: critical (CVSS 10.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-05-21 · updated 2026-06-17
• Weakness: CWE-121

Description

Stack-based Buffer Overflow vulnerability in ZkTeco-based OEM devices allows, in some cases, the execution of arbitrary code. Due to the lack of protection mechanisms such as stack canaries and PIE, it is possible to successfully execute code even under restrictive conditions. This issue affects ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others) with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0 and possibly others.

Affected products

• ZKTeco Facedepot 7B: through ZAM170-NF-1.8.25-7354-Ver1.0.0
• ZKTeco Smartec St Fr041Me: through ZAM170-NF-1.8.25-7354-Ver1.0.0
• ZKTeco Smartec St Fr043: through ZAM170-NF-1.8.25-7354-Ver1.0.0

References

• https://github.com/klsecservices/Advisories/blob/master/K-ZkTeco-2023-006.md
• https://github.com/klsecservices/Advisories/blob/master/K-ZkTeco-2023-006.md

Get alerted when CVE-2023-3943 or the next vulnerability affects your stack