ZKTeco

Records71All Threatist records

Exploited (KEV)1In CISA KEV

CVSS critical13CVSS 9.0–10.0

CVSS high22CVSS 7.0–8.9

Exploited now

ZKTeco records in CISA KEV

TI-2023-20210 ZKTeco BioTime Path Traversal Vulnerability CRITICAL 90KEV 2025-05-19

Components

Products in the NVD configurations · select one to filter the records

Biotime 12 records CRITICAL Zkbio Cvsecurity 8 records HIGH Zkbiosecurity V5000 5 records MEDIUM Bioaccess Ivs 4 records MEDIUM Zktime Web 4 records MEDIUM Facedepot 7b Firmware 2 records MEDIUM Zem800 Firmware 2 records HIGH Zkbiosecurity Server 2 records MEDIUM

Records

8 records in Zkbio Cvsecurity · all components

TI-2025-28829 CVE-2025-45746 · GHSA-rcw6-7x98-m9g9

Hard-coded credentials in ZKTeco ZKBio CVSecurity

HIGH 82

In ZKT ZKBio CVSecurity 6.4.1_R an unauthenticated attacker can craft JWT token using the hardcoded secret to authenticate to the service console.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00367 Published 2025-05-13 Fixed in 6.6.0_R CWE-321

TI-2024-24297 CVE-2024-36526 · GHSA-rfq4-5pwg-672v

ZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key.

HIGH 82

ZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00877 Published 2024-07-09 No fix listed CWE-259

TI-2024-23435 CVE-2024-35431

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64.

HIGH 72

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01 Published 2024-05-30 No fix listed CWE-31

TI-2024-23437 CVE-2024-35433

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Incorrect Access Control.

HIGH 70

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Incorrect Access Control.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00461 Published 2024-05-30 No fix listed CWE-284

TI-2024-23434 CVE-2024-35430

In ZKTeco ZKBio CVSecurity v6.1.1_R and earlier (fixed in 6.1.3_R) an authenticated user…

HIGH 70

In ZKTeco ZKBio CVSecurity v6.1.1_R and earlier (fixed in 6.1.3_R) an authenticated user can bypass password checks while exporting data from the application.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00593 Published 2024-05-30 No fix listed CWE-269

TI-2024-23433 CVE-2024-35429

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via eventRecord.

MEDIUM 62

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via eventRecord.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00947 Published 2024-05-30 No fix listed CWE-31

TI-2024-23436 CVE-2024-35432

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Cross Site Scripting (XSS) via an Audio…

MEDIUM 60

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Cross Site Scripting (XSS) via an Audio File.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00418 Published 2024-05-30 No fix listed CWE-79

TI-2024-23432 CVE-2024-35428

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via BaseMediaFile.

LOW 33

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via BaseMediaFile.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00788 Published 2024-05-30 No fix listed CWE-22

Open these records in search →