The vulnerability is a file path manipulation flaw in ZKTeco ZKBioSecurity 3.0. The application does not properly validate path parameters used to retrieve local resources, enabling an attacker to craft requests that point to arbitrary files on the system. By exploiting this flaw, an attacker can read sensitive files such as configuration files, source code, and other protected application resources. This leads to potential disclosure of credentials, configuration details, and other confidential data, thereby compromising the confidentiality of the system.

The flaw affects ZKTeco Inc. ZKBioSecurity 3.0. The affected version is 3.0; no narrower sub‑version information is available from the CNA. Any deployment of this product without a patch may be vulnerable.

The CVSS score of 6.9 classifies this issue as moderate severity. The EPSS score is less than 1%, indicating a low likelihood of exploitation in the wild, and it is not listed in the CISA KEV catalog. The most probable attack vector is remote; the flaw can be triggered by sending crafted URL parameters to the device's web interface from an external network. Successful exploitation requires network connectivity to the administration interface, but no authentication is needed to read the protected files, making the vulnerability highly dangerous if exposed to untrusted networks.