Chinese-Made Biometric Access System Has 24 Vulnerabilities
A promise of better security through biometrics fell short after security researchers dismantled an access system manufactured by a Chinese manufacture, only to discover 24 vulnerabilities contained inside.
Researchers from Kaspersky examined a biometric access system manufactured by Chinese manufacturer ZKTeco that accepts facial scans as well as passwords, QR codes and an electronic card as authentication methods. The device has different names, depending on its distributor.
One critical flaw, tracked as CVE-2023-3938, enables cybercriminals to perform an SQL attack, injecting malicious code into a terminal's database via QR code in order to obtain unauthorized access to presumably restricted areas. When the terminal processes a malicious QR code, it mistakenly identifies it as coming from a legitimate user. An excess of malicious data causes the device to restart.
