Zkteco vulnerabilities

Products

• Biotime 18
• Zkbio Cvsecurity 8
• Facedepot 7b 6
• Smartec St Fr041me 6
• Smartec St Fr043 6
• Zkbiosecurity V5000 5
• Zkteco-based Oem Devices With Firmware Zam170-nf-1.8.25-7354-ver1.0.0 5
• Zktime Web 5
• Bioaccess Ivs 4
• Zkbio Cvsecurity V5000 3
• Facedepot 7b Firmware 2
• Zem800 Firmware 2
• Zkbiosecurity Server 2

Newest

• zkteco biotime ZKTeco BioTime hard-coded key CVE-2026-108798 6.9 MediumOctober 12, 2026
• zkteco biotime ZKTeco BioTime Employee REST API employees authorization CVE-2026-108797 5.3 MediumOctober 12, 2026
• zkteco biotime ZKTeco BioTime Biometric Data Endpoint finger_data authorization CVE-2026-108796 5.3 MediumOctober 12, 2026
• zkteco biotime ZKTeco BioTime System Settings API systemSettings access control CVE-2026-108795 5.3 MediumOctober 12, 2026
• zkteco biotime ZKTeco BioTime Database Migration Functionality db_migrate_setting sql injection CVE-2026-108794 5.3 MediumOctober 12, 2026
• zkteco ssc335-gc2063-face-0b77 solution camera Unauthenticated Export Service in ZKTeco CCTV Cameras CVE-2026-8598 9.1 CriticalMay 20, 2026
• zkteco biotime ZKTeco BioTime Endpoint safe_setting credentials storage CVE-2025-15128 6.9 MediumDecember 28, 2025
• zkteco biotime ZKTeco BioTime default password CVE-2024-13966 6.9 MediumMay 27, 2025
• zkteco zkbio cvsecurity In ZKT ZKBio CVSecurity 6.4.1_R an unauthenticated attacker can craft JWT token using the... CVE-2025-45746 Disputed 6.5 MediumMay 13, 2025
• zkteco zkbio time ZKTeco ZKBio Time Image File photo direct request CVE-2024-11049 6.3 MediumNovember 10, 2024
• zkteco iclock v3.1-168 ZKteco – CWE 200 Exposure of Sensitive Information to an Unauthorized Actor CVE-2024-45250 4.3 MediumOctober 6, 2024
• zkteco wdms, wdms pro +1 more Cross Site Scripting vulnerability in ZKTeco WDMS v.5.1.3 Pro allows a remote attacker to execute... CVE-2023-51157 5.4 MediumSeptember 25, 2024
• zkteco zktime web An issue in skteco.com Central Control Attendance Machine web management platform v.3.0 allows an... CVE-2024-24257 7.5 HighJuly 26, 2024
• zkteco zkbio cvsecurity ZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key. CVE-2024-36526 9.8 CriticalJuly 9, 2024
• zkteco biotime ZKTeco BioTime system-group-add cross site scripting CVE-2024-6523 5.3 MediumJuly 5, 2024
• zkteco zkbio cvsecurity v5000, zkbiosecurity v5000 +1 more ZKTeco ZKBio CVSecurity V5000 Push Configuration Section cross site scripting CVE-2024-6344 4.8 MediumJune 26, 2024
• zkteco zkbio cvsecurity v5000, zkbiosecurity v5000 +1 more ZKTeco ZKBio CVSecurity V5000 Summer Schedule cross site scripting CVE-2024-6006 5.1 MediumJune 15, 2024
• zkteco zkbio cvsecurity v5000, zkbiosecurity v5000 +1 more ZKTeco ZKBio CVSecurity V5000 Department Section cross site scripting CVE-2024-6005 5.1 MediumJune 15, 2024
• zkteco zkbio cvsecurity ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Incorrect Access Control. An authenticated user, without the permissions of managing users, can create a new admin user. CVE-2024-35433 8.1 HighMay 30, 2024
• zkteco zkbio cvsecurity ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via BaseMediaFile. An authenticated user can delete local files from the server which can lead to DoS. CVE-2024-35428 7.1 HighMay 30, 2024
• zkteco zkbio cvsecurity ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via eventRecord. CVE-2024-35429 6.5 MediumMay 30, 2024
• zkteco zkbio cvsecurity ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user can download local files from the server. NOTE: Third parties have indicated other versions… CVE-2024-35431 7.5 HighMay 30, 2024
• zkteco zkbio cvsecurity ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Cross Site Scripting (XSS) via an Audio File. An authenticated user can injection malicious JavaScript code to trigger a Cross Site Scripting. CVE-2024-35432 6.1 MediumMay 30, 2024
• zkteco zkbio cvsecurity In ZKTeco ZKBio CVSecurity v6.1.1_R and earlier (fixed in 6.1.3_R) an authenticated user can bypass password checks while exporting data from the application. CVE-2024-35430 8.1 HighMay 30, 2024
• zkteco facedepot 7b, smartec st fr041me, smartec st fr043 +1 more +3 more Multiple buffer overflow in ZkTeco-based OEM devices CVE-2023-3943 10.0 CriticalMay 21, 2024
• zkteco facedepot 7b, smartec st fr041me, smartec st fr043 +1 more +3 more Multiple SQLi in ZkTeco-based OEM devices CVE-2023-3942 7.5 HighMay 21, 2024
• zkteco facedepot 7b, smartec st fr041me, smartec st fr043 +1 more +3 more Multiple arbitrary file writes in ZkTeco-based OEM devices CVE-2023-3941 10.0 CriticalMay 21, 2024
• zkteco facedepot 7b, smartec st fr041me, smartec st fr043 +1 more +3 more Multiple arbitrary file reads in ZkTeco-based OEM devices CVE-2023-3940 7.5 HighMay 21, 2024
• zkteco facedepot 7b, smartec st fr041me, smartec st fr043 +1 more +3 more Multiple command injection in ZkTeco-based OEM devices CVE-2023-3939 10.0 CriticalMay 21, 2024
• zkteco facedepot 7b, smartec st fr041me, smartec st fr043 +1 more +3 more Bypassing ZkTeco-based OEM devices/ZKTeco biometric authentication system via SQLi in QR code CVE-2023-3938 4.6 MediumMay 21, 2024
• zkteco biotime An issue in ZKTeco BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive... CVE-2023-51142 7.5 HighMarch 21, 2024
• zkteco biotime An issue in ZKTeko BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive... CVE-2023-51141 6.5 MediumMarch 21, 2024
• zkteco zkbio media ZKTeco ZKBio Media Service Port 9999 download path traversal CVE-2024-2318 5.3 MediumMarch 8, 2024
• zkteco zkbio wdms An issue in zkteco zkbio WDMS v.8.0.5 allows an attacker to execute arbitrary code via the /files... CVE-2024-22988 9.8 CriticalFebruary 23, 2024
• zkteco zkbio access ivs ZKTeco ZKBio Access IVS Department Name Search Bar cross site scripting CVE-2024-1706 5.1 MediumFebruary 21, 2024
• zkteco zem800, zem800 firmware +1 more Insecure direct object reference in ZKTeco ZEM800 CVE-2023-4587 8.3 HighSeptember 4, 2023
• zkteco bioaccess ivs An access control issue in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to... CVE-2023-38958 5.3 MediumAugust 3, 2023
• zkteco bioaccess ivs A path traversal vulnerability in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to... CVE-2023-38956 7.5 HighAugust 3, 2023
• zkteco bioaccess ivs ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to obtain sensitive information... CVE-2023-38955 7.5 HighAugust 3, 2023
• zkteco bioaccess ivs ZKTeco BioAccess IVS v3.3.1 was discovered to contain a SQL injection vulnerability. CVE-2023-38954 9.8 CriticalAugust 3, 2023
• zkteco biotime Insecure access control in ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read... CVE-2023-38952 7.5 HighAugust 3, 2023
• zkteco biotime A path traversal vulnerability in ZKTeco BioTime v8.5.5 allows attackers to write arbitrary files... CVE-2023-38951 9.8 CriticalAugust 3, 2023
• zkteco biotime A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated... CVE-2023-38950 In KEV EPSS 92.5% 7.5 HighAugust 3, 2023
• zkteco biotime An issue in a hidden API in ZKTeco BioTime v8.5.5 allows unauthenticated attackers to arbitrarily... CVE-2023-38949 7.5 HighAugust 3, 2023
• zkteco zem500 firmware, zem510 firmware, zem560 firmware +7 more +9 more Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive... CVE-2022-42953 Public exploit 7.5 HighDecember 25, 2022
• zkteco automatic data master server ZKTeco Xiamen Information Technology ZKBio ECO ADMS <=3.1-164 is vulnerable to Cross Site... CVE-2022-44213 4.8 MediumDecember 9, 2022
• zkteco zktime A default username and password for an administrator account was discovered in ZKTeco ZKTime 10.0... CVE-2021-39434 7.5 HighDecember 5, 2022
• zkteco biotime Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via Leave,... CVE-2022-38803 6.8 MediumNovember 30, 2022
• zkteco biotime Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via resign,... CVE-2022-38802 6.2 MediumNovember 30, 2022
• zkteco biotime In Zkteco BioTime < 8.5.3 Build:20200816.447, an employee can hijack an administrator session and... CVE-2022-38801 5.4 MediumNovember 30, 2022
• Show olderLoading…