# CVE-2023-38950: ZKBio Time - Path Traversal

> Live exploitation tracking for CVE-2023-38950 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2023-38950

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 7.5
- **Public exploit available:** Yes
- **Affected products:** ZKTeco ZKBio Time
- **Weaknesses:** CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
- **Tags:** enterprise_software

## Description

A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload.

## CrowdSec analysis

[CVE-2023-38950](https://euvd.enisa.europa.eu/vulnerability/CVE-2023-38950) is a path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 which allows unauthenticated attackers to read arbitrary files on the server by sending specially crafted requests. This security flaw could be exploited to access sensitive information, configuration files, or credentials, potentially leading to further attacks on the affected system.

CrowdSec has been tracking this vulnerability and its exploits since 25th of June 2025.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2023-38950 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting.
Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2023-38950 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2023-38950 is currently experiencing high visibility and active exploitation across the internet.

Attackers exploit the `/iclock/file` endpoint by supplying directory traversal sequences in the `url` parameter to access arbitrary files on the server.

## Timeline

- 2023-08-03: CVE Published. CVE-2023-38950 is published to NVD.
- 2025-05-19: CISA KEV. CVE-2023-38950 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2025-06-09: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2025-06-25: Rule Released. CrowdSec releases a rule to detect CVE-2023-38950 exploitation attempts against the CrowdSec Network.
- 2025-06-25: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2023-38950 for the first time.

## References

- https://claroty.com/team82/disclosure-dashboard/cve-2023-38950
- https://www.fortinet.com/content/dam/fortinet/assets/reports/report-incident-response-middle-east.pdf
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-38950.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2023-38950) follows observed exploitation activity for CVE-2023-38950. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.