Insecure File Permissions in ZKTeco ZKTime.Net 3.0.1.6 Exposes Users to Privilege Escalation

What changed

The recent discovery of an insecure file permissions vulnerability in ZKTeco ZKTime.Net 3.0.1.6 has raised concerns regarding user privilege escalation. This flaw allows unprivileged users to modify executable files, potentially leading to unauthorized access and control over the system.

The vulnerability stems from world-writable permissions on the ZKTimeNet3.0 directory, enabling attackers to replace legitimate executables with malicious binaries.

Who is affected

The vulnerability impacts various stakeholders who utilize ZKTeco's biometric and time management solutions. Organizations relying on this software could face significant security risks if not addressed promptly.

Key affected groups include:

• Businesses using ZKTeco ZKTime.Net for employee time tracking and attendance management.
• Organizations that integrate ZKTeco products into their security systems.
• IT departments responsible for maintaining the integrity of ZKTeco software installations.

What to do

Affected users and organizations should take immediate action to mitigate the risks associated with this vulnerability. Regularly reviewing file permissions and ensuring that only authorized personnel have access to critical system files is crucial.

Additionally, organizations should consider updating to the latest version of ZKTeco software or applying any available patches to address the identified vulnerabilities.

• Conduct a security audit of file permissions within the ZKTimeNet3.0 directory.
• Limit access to executable files to only those users who require it.
• Stay informed about updates from ZKTeco regarding this vulnerability and any recommended security measures.