CVE-2024-2318 is a medium severity (4.3) path traversal in ZKTeco ZKBio Media 2.0.0 that lets a low-privilege user read files through the download endpoint. ZKTeco lists version 2.1.3 (build 2025-05-26-1605) as the fix. Upgrade and restrict port 9999. NVD published it on 2024-03-08.
Weakness: CWE-23 (Relative Path Traversal), CWE-24 (Path Traversal: ../filedir), CWE-22 (Path Traversal).
What's affected
- Affected: ZKTeco ZKBio Media 2.0.0_x64_2024-01-29-1028 per the record. The ZKTeco bulletin says builds before 2.1.2_x64_2024-01-29-1028 are affected.
- Fixed: version 2.1.3, build 2025-05-26-1605, per the record and the ZKTeco bulletin.
- Attack conditions:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, which means network reachable with a low-privilege account and no user interaction.
Source conflict to note: the record names build 2.0.0_x64_2024-01-29-1028 as affected, while the bulletin text says builds before 2.1.2_x64_2024-01-29-1028. Both lead to the same advice, which is to move to 2.1.3.
The record says the weakness is in /pro/common/download on service port 9999, through the fileName argument. It says the exploit has been disclosed to the public.
How to check if you're exposed
- Open ZKBio Media and note the build string, then compare it to 2.1.3 Build 2025-05-26-1605.
- Check whether service port 9999 is reachable from outside the network, for example with
nc -zv HOST 9999from a test machine you control. - Review access logs for requests to /pro/common/download that contain dot-dot sequences.
If you track dependencies, the free in-browser dependency scan can show whether a library or package in your project matches a known CVE. It will not find a standalone PHP application or a firmware image that was never packaged as a dependency, so keep your own inventory of those.
What to do now
- Back up all system data, as the ZKTeco bulletin advises, then upgrade ZKBio Media to 2.1.3 Build 2025-05-26-1605.
- Obtain the patch through ZKTeco support or your local branch office, as the bulletin directs.
- Until upgraded, close unneeded ports, restrict access permissions as far as possible and apply the additional hardening the bulletin lists.
- Check whether database files or configuration were readable and rotate credentials stored in them if you cannot rule out access.
- Add the product and version to your inventory.
Why it matters
The record classes this as CWE-23 (Relative Path Traversal), CWE-24 (Path Traversal: ../filedir), CWE-22 (Path Traversal). A download handler that builds a file path from user input and does not confine it to a folder lets a caller step up out of that folder. The record's example target is a SQL file, which shows why database dumps and configuration files are the usual prize.
NVD scored it 4.3 (Medium) because only confidentiality is affected. The ZKTeco bulletin says successful exploitation could lead to unauthorized data access and potential data leakage. The KEV flag is false.
Quick check
Which version fixes CVE-2024-2318?
ZKTeco lists 2.1.3 Build 2025-05-26-1605. Request it through ZKTeco support.
Why do the record and the bulletin differ?
The record says 2.0.0 in build 2.0.0_x64_2024-01-29-1028, while the bulletin says builds before 2.1.2_x64_2024-01-29-1028. Treat any build older than 2.1.3 as affected.
Sources
- CVE-2024-2318 record on Safeguard Gold
- NVD description and CVSS vector for CVE-2024-2318, as held in the batch record
- ZKTeco security bulletin
- Public write-up referenced by the record
Last reviewed: 19 October 2026.
