CVE-2024-6344

· LOWModified

← All CVEs

CVSS v3.1

2.4

CVSS v4.0

1.9

EPSS

0.38%

Published

Jun 26, 2024

Modified

Apr 28, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

A vulnerability, which was classified as problematic, was found in ZKTeco ZKBio CVSecurity V5000 4.1.0. This affects an unknown part of the component Push Configuration Section. The manipulation of the argument Configuration Name leads to cross site scripting. It is possible to initiate the attack remotely. It is recommended to upgrade the affected component. The vendor explains, that "[s]ince ZKBio CVSecurity v5000 has been withdrawn from the market, we recommend upgrading to ZKBio CVSecurity V6600 6.1.3_R or above". This vulnerability only affects products that are no longer supported by the maintainer.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N

Weaknesses (CWE)

CWE-79CWE-94

Affected Products (1)

zkteco · zkbiosecurity_v5000vulnerable

References (8)

https://vuldb.com/?ctiid.269733

Permissions RequiredVDB Entry

https://vuldb.com/?id.269733

Third Party AdvisoryVDB Entry

https://vuldb.com/?submit.358596