Vulnerabilities

TI-2025-28829 CVE-2025-45746 · GHSA-rcw6-7x98-m9g9

Hard-coded credentials in ZKTeco ZKBio CVSecurity

HIGH 82

In ZKT ZKBio CVSecurity 6.4.1_R an unauthenticated attacker can craft JWT token using the hardcoded secret to authenticate to the service console.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00367 Published 2025-05-13 Fixed in 6.6.0_R CWE-321

TI-2024-24297 CVE-2024-36526 · GHSA-rfq4-5pwg-672v

ZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key.

HIGH 82

ZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00877 Published 2024-07-09 No fix listed CWE-259

TI-2024-23437 CVE-2024-35433

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Incorrect Access Control.

HIGH 70

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Incorrect Access Control.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00461 Published 2024-05-30 No fix listed CWE-284

TI-2024-23432 CVE-2024-35428

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via BaseMediaFile.

LOW 33

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via BaseMediaFile.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00788 Published 2024-05-30 No fix listed CWE-22

TI-2024-23433 CVE-2024-35429

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via eventRecord.

MEDIUM 62

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via eventRecord.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00947 Published 2024-05-30 No fix listed CWE-31

TI-2024-23435 CVE-2024-35431

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64.

HIGH 72

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01 Published 2024-05-30 No fix listed CWE-31

TI-2024-23436 CVE-2024-35432

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Cross Site Scripting (XSS) via an Audio…

MEDIUM 60

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Cross Site Scripting (XSS) via an Audio File.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00418 Published 2024-05-30 No fix listed CWE-79

TI-2024-23434 CVE-2024-35430

In ZKTeco ZKBio CVSecurity v6.1.1_R and earlier (fixed in 6.1.3_R) an authenticated user…

HIGH 70

In ZKTeco ZKBio CVSecurity v6.1.1_R and earlier (fixed in 6.1.3_R) an authenticated user can bypass password checks while exporting data from the application.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00593 Published 2024-05-30 No fix listed CWE-269

Vulnerabilities

Filters