İçeriğe atla
Noroxi

ZKTeco kayıtları

zkteco üreticisine ait 51 yayımlanmış kayıt.

Araştırmacı profili

KEV’e giren
1 · %2
Silahlaştırılmış
1 · %2
Pre-auth RCE
5
Düzeltme kaydı olan
%5,9
Yayından KEV’e ortanca
655 gün

Yıllara göre kayıt

  1. 17
  2. 20
  3. 22
  4. 23
  5. 24
  6. 25

Çubuk: toplam · koyu kısım: CISA KEV.

Tekrar eden sınıflar

Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.

CWE

Saldırı profili

Tüm kayıtlar

51 kayıt
  • CVE-2023-38950
    88Hemen

    A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via suppl

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %92

    zkteco · biotime3 Ağu 2023

  • CVE-2022-36635
    40Planlayın

    ZKteco ZKBioSecurity V5000 4.1.3 was discovered to contain a SQL injection vulnerability via the component /baseOpLog.do.

    YüksekCVSS 8,8İstismar yokEPSS %17

    zkteco · zkbiosecurity v50007 Eki 2022

  • CVE-2023-38951
    40Planlayın

    ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the

    KritikCVSS 9,8Kavram kanıtıEPSS %3

    zkteco · biotime3 Ağu 2023

  • CVE-2023-3939
    40Planlayın

    Multiple command injection in ZkTeco-based OEM devices

    KritikCVSS 10,0İstismar yokEPSS %1

    zkteco · zkteco-based oem devices with firmware zam170-nf-1.8.25-7354-ver1.0.021 May 2024

  • CVE-2023-3943
    40Planlayın

    Multiple buffer overflow in ZkTeco-based OEM devices

    KritikCVSS 10,0İstismar yokEPSS %0

    zkteco · zkteco-based oem devices with firmware zam170-nf-1.8.25-7354-ver1.0.021 May 2024

  • CVE-2023-3941
    40Planlayın

    Multiple arbitrary file writes in ZkTeco-based OEM devices

    KritikCVSS 10,0İstismar yokEPSS %0

    zkteco · zkteco-based oem devices with firmware zam170-nf-1.8.25-7354-ver1.0.021 May 2024

  • CVE-2020-17474
    39İzleyin

    A token-reuse vulnerability in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723 allows an attacker to create arbitrary ne

    KritikCVSS 9,8İstismar yokEPSS %1

    zkteco · zkbiosecurity server14 Ağu 2020

  • CVE-2024-36526
    39İzleyin

    ZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key.

    KritikCVSS 9,8İstismar yokEPSS %0

    zkteco · zkbio cvsecurity9 Tem 2024

  • CVE-2024-22988
    39İzleyin

    ZKteco ZKBio WDMS before 9.0.2 Build 20250526 allows an attacker to download a database backup via the /files/backup/ component because the

    KritikCVSS 9,8İstismar yokEPSS %0

    zkteco · zkbio wdms23 Şub 2024

  • CVE-2023-38954
    39İzleyin

    ZKTeco BioAccess IVS v3.3.1 was discovered to contain a SQL injection vulnerability.

    KritikCVSS 9,8İstismar yokEPSS %0

    zkteco · bioaccess ivs2 Ağu 2023

  • CVE-2025-45746
    39İzleyin

    In ZKT ZKBio CVSecurity 6.4.1_R an unauthenticated attacker can craft JWT token using the hardcoded secret to authenticate to the service co

    KritikCVSS 9,8İstismar yokEPSS %0

    zkteco · zkbio cvsecurity13 May 2025

  • CVE-2022-36634
    35İzleyin

    An access control issue in ZKTeco ZKBioSecurity V5000 3.0.5_r allows attackers to arbitrarily create admin users via a crafted HTTP request.

    YüksekCVSS 8,8İstismar yokEPSS %1

    zkteco · zkbiosecurity v50007 Eki 2022

  • CVE-2017-17056
    35İzleyin

    The ZKTime Web Software 2.0.1.12280 allows the Administrator to elevate the privileges of the application user using a 'password_change()' f

    YüksekCVSS 8,8İstismar yokEPSS %0

    zkteco · zktime web4 Ara 2017

  • CVE-2022-42953
    32İzleyin

    Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive information via direct requests for the form

    YüksekCVSS 7,5Kavram kanıtıEPSS %5

    zkteco · zmm200 firmware25 Ara 2022

  • CVE-2017-13129
    32İzleyin

    Cross-site request forgery (CSRF) vulnerability in ZKTeco ZKTime Web 2.0.1.12280 allows remote authenticated users to hijack the authenticat

    YüksekCVSS 8,0Kavram kanıtıEPSS %1

    zkteco · zktime web26 Eyl 2017

  • CVE-2024-35430
    32İzleyin

    In ZKTeco ZKBio CVSecurity v6.1.1_R and earlier (fixed in 6.1.3_R) an authenticated user can bypass password checks while exporting data fro

    YüksekCVSS 8,1İstismar yokEPSS %0

    zkteco · zkbio cvsecurity30 May 2024

  • CVE-2024-35433
    32İzleyin

    ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Incorrect Access Control.

    YüksekCVSS 8,1İstismar yokEPSS %0

    zkteco · zkbio cvsecurity30 May 2024

  • CVE-2017-14680
    31İzleyin

    ZKTeco ZKTime Web 2.0.1.12280 allows remote attackers to obtain sensitive employee metadata via a direct request for a PDF document.

    YüksekCVSS 7,5Kavram kanıtıEPSS %4

    zkteco · zktime web21 Eyl 2017

  • CVE-2023-38952
    31İzleyin

    Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that ses

    YüksekCVSS 7,5Kavram kanıtıEPSS %2

    zkteco · biotime3 Ağu 2023

  • CVE-2024-35431
    30İzleyin

    ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64.

    YüksekCVSS 7,5İstismar yokEPSS %1

    zkteco · zkbio cvsecurity30 May 2024

  • CVE-2023-3940
    30İzleyin

    Multiple arbitrary file reads in ZkTeco-based OEM devices

    YüksekCVSS 7,5İstismar yokEPSS %0

    zkteco · zkteco-based oem devices with firmware zam170-nf-1.8.25-7354-ver1.0.021 May 2024

  • CVE-2023-51142
    30İzleyin

    An issue in ZKTeco BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive information.

    YüksekCVSS 7,5İstismar yokEPSS %0

    zkteco · biotime10 Nis 2024

  • CVE-2023-38956
    30İzleyin

    A path traversal vulnerability in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to read arbitrary files via supplying a craft

    YüksekCVSS 7,5İstismar yokEPSS %0

    zkteco · bioaccess ivs2 Ağu 2023

  • CVE-2023-38955
    30İzleyin

    ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to obtain sensitive information about all managed devices, including their IP a

    YüksekCVSS 7,5İstismar yokEPSS %0

    zkteco · bioaccess ivs2 Ağu 2023

  • CVE-2023-3942
    30İzleyin

    Multiple SQLi in ZkTeco-based OEM devices

    YüksekCVSS 7,5İstismar yokEPSS %0

    zkteco · zkteco-based oem devices with firmware zam170-nf-1.8.25-7354-ver1.0.0, standalone service v. 2.1.6-2020090721 May 2024