Skip to content
OpenAdvisories

Vendor

ZKTeco

37 known vulnerabilities.

Products

BioTime 8 ZKTeco ZKBioSecurity 6 ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0 5 WL20 Biometric Attendance System 4 ZKBio CVSecurity V5000 3 SSC335-GC2063-Face-0b77 Solution Camera 1 ZKTeco ZKAccess Security System 1 ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0, Standalone service v. 2.1.6-20200907 1 ZKTeco ZKAccess Professional 1 ZKBio Access IVS 1 ZKBio CVSecurity 1 ZKBio Time 1 ZKTeco ZKTime.Net 1 iClock v3.1-168 1 ZEM800 1 ZKBio Media 1 SSC335-GC2063-Face-0b77 Solution 0
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-8598

    Unauthenticated Export Service in ZKTeco CCTV Cameras

    An undocumented configuration export port is accessible on some models of ZKTeco CCTV cameras. This port does not require authentication and exposes critical information about the camera such as open services and camera account credentials.

    ZKTeco SSC335-GC2063-Face-0b77 Solution Camera
  • Critical 9.8
    CVE-2016-20030

    ZKTeco ZKBioSecurity 3.0 User Enumeration via authLoginAction

    ZKTeco ZKBioSecurity 3.0 contains a user enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by submitting partial characters via the username parameter. Attackers can send requests to the authLoginAction!login.do scrip…

    ZKTeco ZKTeco ZKBioSecurity
  • Critical 9.8
    CVE-2016-20026

    ZKTeco ZKBioSecurity 3.0 Hardcoded Credentials Remote Code Execution

    ZKTeco ZKBioSecurity 3.0 contains hardcoded credentials in the bundled Apache Tomcat server that allow unauthenticated attackers to access the manager application. Attackers can authenticate with hardcoded credentials stored in tomcat-users.xml to upload mali…

    ZKTeco ZKTeco ZKBioSecurity
  • Critical 9.8
    CVE-2016-20024

    ZKTeco ZKTime.Net 3.0.1.6 Insecure File Permissions Privilege Escalation

    ZKTeco ZKTime.Net 3.0.1.6 contains an insecure file permissions vulnerability that allows unprivileged users to escalate privileges by modifying executable files. Attackers can exploit world-writable permissions on the ZKTimeNet3.0 directory and its contents …

    ZKTeco ZKTeco ZKTime.Net
  • Critical 10.0
    CVE-2023-3943

    Multiple buffer overflow in ZkTeco-based OEM devices

    Stack-based Buffer Overflow vulnerability in ZkTeco-based OEM devices allows, in some cases, the execution of arbitrary code. Due to the lack of protection mechanisms such as stack canaries and PIE, it is possible to successfully execute code even under restr…

    ZKTeco ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0
  • Critical 10.0
    CVE-2023-3941

    Multiple arbitrary file writes in ZkTeco-based OEM devices

    Relative Path Traversal vulnerability in ZkTeco-based OEM devices allows an attacker to write any file on the system with root privileges. This issue affects ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others)…

    ZKTeco ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0
  • Critical 10.0
    CVE-2023-3939

    Multiple command injection in ZkTeco-based OEM devices

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in ZkTeco-based OEM devices allows OS Command Injection. Since all the found command implementations are executed from the superuser, their impact is the …

    ZKTeco ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0