Scores of Biometrics Bugs Emerge, Highlighting Authentication Risks

*Executive summary:* Kaspersky researchers found roughly two dozen vulnerabilities in ZKTeco biometric access terminals — including SQL injection, path traversal, input-validation flaws, and privileged command execution (notable examples CVE-2023-3938, CVE-2023-3939, CVE-2023-3940–3943) — that could allow attackers to extract biometric data and password hashes, modify device databases (e.g., add attacker faces), execute commands, and bypass physical access controls via manipulated QR codes; the devices are widely deployed in critical facilities which raises concern despite no confirmed active exploitation publicly reported. Recommended mitigations include isolating biometric readers on separate network segments, replacing default credentials, auditing device configurations, and protecting biometric stores with hardware-backed encryption.