Read the docs
TI-2025-28829 Aliases CVE-2025-45746GHSA-rcw6-7x98-m9g9

Hard-coded credentials in ZKTeco ZKBio CVSecurity

Priority HIGH 82CWE-321Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-321.

Summary

In ZKT ZKBio CVSecurity 6.4.1_R an unauthenticated attacker can craft JWT token using the hardcoded secret to authenticate to the service console. NOTE: the Supplier disputes the significance of this report because the service console is typically only accessible from a local area network, and because access to the service console does not result in login access or data access in the context of the application software platform.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00367 30th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed ZKBio CVSecurity (ZKTeco): 6.6.0_R

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ZKTecoZKBio CVSecurity6.4.1_R to before 6.6.0_R6.6.0_RPatch availableCNA
  • ZKBio CVSecurity VendorZKTeco Affected 6.4.1_R to before 6.6.0_R Fixed in 6.6.0_R Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:zkteco:zkbio_cvsecurity:6.4.1_r:*:*:*:*:*:*:*6.4.1_rVulnerableZKTeco
  • cpe:2.3:a:zkteco:zkbio_cvsecurity:6.4.1_r:*:*:*:*:*:*:* Versions 6.4.1_r Vulnerable ·ZKTeco

Remediation

  • Fix · CNA ZKBio CVSecurity (ZKTeco) Fixed in 6.6.0_R

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-45746
  2. 2026-10-03 Alias added: GHSA-rcw6-7x98-m9g9

References

Exploit 1

  • TI-2024-24297 ZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key. CVSS 3.1CRITICAL 9.8
  • TI-2024-23435 ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. CVSS 3.1HIGH 7.5
  • TI-2024-23437 ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Incorrect Access Control. CVSS 3.1HIGH 8.1
  • TI-2024-23434 In ZKTeco ZKBio CVSecurity v6.1.1_R and earlier (fixed in 6.1.3_R) an authenticated user… CVSS 3.1HIGH 8.1
  • TI-2024-23433 ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via eventRecord. CVSS 3.1MEDIUM 6.5
  • TI-2024-23436 ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Cross Site Scripting (XSS) via an Audio… CVSS 3.1MEDIUM 6.1
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences