CVE-2024-1706

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-1706
A vulnerability was determined in ZKTeco ZKBio Access IVS up to 3.3.2. This impacts an unknown function of the component Department Name Search Bar. This manipulation with the input <marquee>hi causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor explains: "ZKBio Access IVS is no longer maintained and the product has been replaced by ZKBio CVAccess, it is recommended to replace it with the latest version of ZKBio CVAccess." This vulnerability only affects products that are no longer supported by the maintainer.

3.5 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 2.1 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

4.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:N/I:P/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
https://gist.githubusercontent.com/whiteman007/8d3a09991de4ef336937ba91c07b7856/raw/adc00538d7a8c3c54bde4797a10d9b6af393711d/gistfile1.txt Third Party Advisory
https://vuldb.com/?ctiid.254396 Permissions Required
https://vuldb.com/?id.254396 Third Party Advisory
https://vuldb.com/?submit.280083
https://vuldb.com/?submit.280084
https://www.zkteco.com/en/Security_Bulletinsibs/21
https://gist.githubusercontent.com/whiteman007/8d3a09991de4ef336937ba91c07b7856/raw/adc00538d7a8c3c54bde4797a10d9b6af393711d/gistfile1.txt Third Party Advisory
https://vuldb.com/?ctiid.254396 Permissions Required
https://vuldb.com/?id.254396 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:zkteco:zkbio_access_ivs:*:*:*:*:*:*:*:*
History

22 Aug 2025, 08:15

Type Values Removed Values Added
References
  • () https://vuldb.com/?submit.280083 -
  • () https://vuldb.com/?submit.280084 -
  • () https://www.zkteco.com/en/Security_Bulletinsibs/21 -
Summary (en) A vulnerability, which was classified as problematic, has been found in ZKTeco ZKBio Access IVS up to 3.3.2. Affected by this issue is some unknown functionality of the component Department Name Search Bar. The manipulation with the input <marquee>hi leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-254396. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. (en) A vulnerability was determined in ZKTeco ZKBio Access IVS up to 3.3.2. This impacts an unknown function of the component Department Name Search Bar. This manipulation with the input <marquee>hi causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor explains: "ZKBio Access IVS is no longer maintained and the product has been replaced by ZKBio CVAccess, it is recommended to replace it with the latest version of ZKBio CVAccess." This vulnerability only affects products that are no longer supported by the maintainer.
CWE CWE-94

12 Feb 2025, 01:03

Type Values Removed Values Added
References () https://gist.githubusercontent.com/whiteman007/8d3a09991de4ef336937ba91c07b7856/raw/adc00538d7a8c3c54bde4797a10d9b6af393711d/gistfile1.txt - () https://gist.githubusercontent.com/whiteman007/8d3a09991de4ef336937ba91c07b7856/raw/adc00538d7a8c3c54bde4797a10d9b6af393711d/gistfile1.txt - Third Party Advisory
References () https://vuldb.com/?ctiid.254396 - () https://vuldb.com/?ctiid.254396 - Permissions Required
References () https://vuldb.com/?id.254396 - () https://vuldb.com/?id.254396 - Third Party Advisory
First Time Zkteco zkbio Access Ivs
Zkteco
CPE cpe:2.3:a:zkteco:zkbio_access_ivs:*:*:*:*:*:*:*:*

21 Nov 2024, 08:51

Type Values Removed Values Added
References () https://gist.githubusercontent.com/whiteman007/8d3a09991de4ef336937ba91c07b7856/raw/adc00538d7a8c3c54bde4797a10d9b6af393711d/gistfile1.txt - () https://gist.githubusercontent.com/whiteman007/8d3a09991de4ef336937ba91c07b7856/raw/adc00538d7a8c3c54bde4797a10d9b6af393711d/gistfile1.txt -
References () https://vuldb.com/?ctiid.254396 - () https://vuldb.com/?ctiid.254396 -
References () https://vuldb.com/?id.254396 - () https://vuldb.com/?id.254396 -

22 Feb 2024, 19:07

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad fue encontrada en ZKTeco ZKBio Access IVS hasta 3.3.2 y clasificada como problemática. Una función desconocida del componente Department Name Search Bar es afectada por esta vulnerabilidad. La manipulación con la entrada hi conduce a Cross-Site Scripting. El ataque puede lanzarse de forma remota. El exploit ha sido divulgado al público y puede utilizarse. El identificador de esta vulnerabilidad es VDB-254396. NOTA: Se contactó primeramente con el proveedor sobre esta divulgación, pero no respondió de ninguna manera.

21 Feb 2024, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-21 18:15

Updated : 2025-08-22 08:15

NVD link : CVE-2024-1706

Mitre link : CVE-2024-1706

CVE.ORG link : CVE-2024-1706

JSON object : View

Products Affected

zkteco

  • zkbio_access_ivs
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-94

Improper Control of Generation of Code ('Code Injection')