{"id":"CVE-2022-42953","aliases":["EUVD-2022-46008","GHSA-54r9-6x6g-2vfv"],"status":"published","title":"Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive...","description":"Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive information via direct requests for the form/DataApp?style=1 and form/DataApp?style=0 URLs. The affected versions may be before 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720) and 15.00 (ZMM200-220-210). The fixed versions are firmware version 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720) and firmware version 15.00 (ZMM200-220-210).","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.05156,"percentile":0.92489,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-425","CWE-668"],"published":"2022-12-25T00:00:00Z","modified":"2026-06-17T05:05:39Z","exploits":[{"source":"exploitdb","id":"EDB-51112","title":"ZKTeco ZEM/ZMM 8.88 - Missing Authentication","type":"webapps","platform":"jsp","date":"2023-03-28","url":"https://www.exploit-db.com/exploits/51112"}],"products":[{"vendor":"zkteco","product":"zem500_firmware"},{"vendor":"zkteco","product":"zem510_firmware"},{"vendor":"zkteco","product":"zem560_firmware"},{"vendor":"zkteco","product":"zem600_firmware"},{"vendor":"zkteco","product":"zem720_firmware"},{"vendor":"zkteco","product":"zem760_firmware"},{"vendor":"zkteco","product":"zem800_firmware"},{"vendor":"zkteco","product":"zmm200_firmware"},{"vendor":"zkteco","product":"zmm210_firmware"},{"vendor":"zkteco","product":"zmm220_firmware"}],"references":[{"url":"https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://seclists.org/fulldisclosure/2022/Oct/23","tags":["x_transferred","Exploit","Mailing List","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-42953"},{"url":"https://github.com/advisories/GHSA-54r9-6x6g-2vfv"}],"sources":{"cve":[{"id":"CVE-2022-42953","description":"Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive information via direct requests for the form/DataApp?style=1 and form/DataApp?style=0 URLs. The affected versions may be before 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720) and 15.00 (ZMM200-220-210). The fixed versions are firmware version 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720) and firmware version 15.00 (ZMM200-220-210).","status":"published","published":"2022-12-25T00:00:00Z","modified":"2025-04-15T13:33:43.485Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-425"],"updated_at":"2026-11-02T14:34:27.640972Z"}],"euvd":[{"id":"EUVD-2022-46008","description":"Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive information via direct requests for the form/DataApp?style=1 and form/DataApp?style=0 URLs. The affected versions may be before 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720) and 15.00 (ZMM200-220-210). The fixed versions are firmware version 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720) and firmware version 15.00 (ZMM200-220-210).","status":"published","published":"2022-12-25T00:00:00Z","modified":"2025-04-15T13:33:43Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T20:52:30.575698Z"}],"ghsa":[{"id":"GHSA-54r9-6x6g-2vfv","title":"Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive...","description":"Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive information via direct requests for the form/DataApp?style=1 and form/DataApp?style=0 URLs. The affected versions may be before 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720) and 15.00 (ZMM200-220-210). The fixed versions are firmware version 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720) and firmware version 15.00 (ZMM200-220-210).","status":"published","published":"2022-12-25T06:30:21Z","modified":"2025-04-15T15:30:45Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-425","CWE-668"],"updated_at":"2026-11-02T15:01:32.576314Z"}],"nvd":[{"id":"CVE-2022-42953","description":"Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive information via direct requests for the form/DataApp?style=1 and form/DataApp?style=0 URLs. The affected versions may be before 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720) and 15.00 (ZMM200-220-210). The fixed versions are firmware version 8.88 (ZEM500-510-560-760, ZEM600-800, ZEM720) and firmware version 15.00 (ZMM200-220-210).","status":"published","published":"2022-12-25T05:15:10.433Z","modified":"2026-06-17T05:05:39.78Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-425"],"updated_at":"2026-11-02T14:07:34.388163Z"}]}}