Is CVE-2023-38950 (ZKTeco BioTime Path Traversal) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Cyber Security

Yes. CISA added CVE-2023-38950 to its Known Exploited Vulnerabilities catalogue on 19 May 2025, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. ZKTeco BioTime contains a path traversal vulnerability in the iclock API that allows an unauthenticated attacker to read arbitrary files via supplying a crafted payload.

What “being exploited in the wild” means for this CVE

For a vulnerability like CVE-2023-38950, “exploited in the wild” means more than theoretical risk. It indicates there is credible evidence that attackers have already used the flaw against real targets, so the issue should be treated as an active exposure, not a routine backlog item. The practical question shifts from whether the bug is real to whether your instance is reachable, observable, and already affected.

CISA’s KEV catalogue is the operational signal that matters here, and the CISA Known Exploited Vulnerabilities Catalog is the place to confirm whether the vulnerability has crossed that threshold. For verification and triage, the NIST National Vulnerability Database and the CVE Program remain the authoritative references for record-level identification and tracking.

Why this path traversal matters operationally

The underlying issue is path traversal in the iclock API, which means an unauthenticated request can be manipulated to reach files outside the intended path. That is dangerous even when the exploit is “only” read access, because file disclosure often exposes configuration, tokens, logs, or other material that supports follow-on intrusion. The practical risk is not just data exposure, but accelerated compromise of the surrounding environment.

Path traversal also tends to be simple to automate and easy to miss in basic monitoring because the traffic can look like ordinary web requests. If the vulnerable service is internet-facing, the attacker does not need prior access, which lowers the cost of exploitation and increases the chance of opportunistic scanning. The Web Application Attacks Guide is useful background for recognising how directory traversal fits into a broader application-attack pattern.

Because this is an actively exploited vulnerability, the relevant question is not whether the flaw is novel, but whether the exposed file paths include anything sensitive enough to help an attacker pivot. In practice, file reads can become a stepping stone to credential theft, session abuse, or discovery of internal endpoints and backup material.

What to do before and after patching

Confirm whether any ZKTeco BioTime instance is reachable from untrusted networks, whether the iclock API is exposed, and whether your environment still contains versions affected by the issue. Then apply the vendor’s remediation path as soon as possible, using the vendor advisory and CISA KEV entry for version-specific instructions rather than relying on summaries alone. Where a fix cannot be installed immediately, reduce exposure by removing external reachability, restricting access paths, and isolating the service from broader trust zones.

If patching must wait, treat the gap as an active containment problem, not a deferred maintenance item. That means limiting who can reach the application, watching for unusual file-access patterns, and preserving evidence that can show whether the path traversal has been used already. For broader prioritisation of exploited flaws, FIRST EPSS can help rank urgency, while NHIMG’s Zero-Day and Exploited Vulnerabilities Guide covers the response pattern for KEV-listed weaknesses.

Risk and Threat Considerations

An exploited path traversal bug is especially risky when the target application stores credentials, configuration, or customer data in readable locations. Once attackers can read arbitrary files, they can often collect enough environmental detail to shorten the path to deeper compromise, even if the initial bug is “read-only.”

Failure mechanism: The attacker supplies a crafted path payload to the iclock API and forces the application to resolve files outside the intended directory boundary, bypassing normal access assumptions.

Impact: Sensitive files may be disclosed, which can expose secrets, internal structure, or operational data and create a second-stage compromise path well beyond the original application.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5, CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	SI-10 — Information Input Validation	Path traversal is an input validation failure that lets crafted paths access unintended files.
	AC-6 — Least Privilege	Limiting the application’s file access reduces the blast radius of arbitrary file reads.
	RA-5 — Vulnerability Monitoring and Scanning	KEV-listed exploitation requires active identification and prioritisation of exposed instances.
Recommendation — Validate file paths and reject traversal sequences before they reach filesystem operations. Restrict the service account to the minimum file and directory access it needs. Continuously identify vulnerable instances and prioritise KEV-listed issues for immediate action.
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Actively exploited vulnerabilities require prioritised scanning, triage and remediation.
Recommendation — Track exposed BioTime instances and remediate exploited vulnerabilities on an emergency timeline.
OWASP ASVS	V5 — File Handling	Directory traversal directly targets unsafe file access and path handling in the application layer.
Recommendation — Enforce strict server-side path normalisation and canonicalisation for all file access.

Practitioner Guidance

What to verify: Check whether any BioTime deployment is internet-facing, whether the iclock API is reachable, and whether logs show unusual traversal strings or repeated file-read attempts. If the service has been exposed publicly, assume it may already have been probed.

Decision rule: If the vulnerable instance can access files containing credentials, configuration, or backup material, prioritise containment and compromise assessment alongside remediation. If the service is isolated and tightly scoped, the response can focus more quickly on patching and log review.

Evidence to retain: Preserve web logs, application logs, and any reverse proxy or WAF telemetry that can show request paths, source IPs, and repeated attempts. That evidence is often more useful than trying to infer impact from the current state of the application alone.

Practitioner takeaway: Once CISA places a CVE in KEV, treat exposure as an active operational problem, not a theoretical one, and verify both patch status and whether the flaw has already been used to read anything sensitive.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org