Skip to content
OpenAdvisories

Vendor

ZKTeco

37 known vulnerabilities.

Products

BioTime 8 ZKTeco ZKBioSecurity 6 ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0 5 WL20 Biometric Attendance System 4 ZKBio CVSecurity V5000 3 SSC335-GC2063-Face-0b77 Solution Camera 1 ZKTeco ZKAccess Security System 1 ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0, Standalone service v. 2.1.6-20200907 1 ZKTeco ZKAccess Professional 1 ZKBio Access IVS 1 ZKBio CVSecurity 1 ZKBio Time 1 ZKTeco ZKTime.Net 1 iClock v3.1-168 1 ZEM800 1 ZKBio Media 1 SSC335-GC2063-Face-0b77 Solution 0
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 7.3
    CVE-2026-108798

    ZKTeco BioTime hard-coded key

    A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unknown processing. The manipulation results in use of hard-coded cryptographic key . The attack may be launched remotely. Upgrading to version 9.5.6 Build 3623 is …

    ZKTeco BioTime
  • High 7.2
    CVE-2016-20032

    ZKTeco ZKAccess Security System 5.3.1 Stored XSS

    ZKTeco ZKAccess Security System 5.3.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by injecting malicious payloads through the 'holiday_name' and 'memo' POST parameters. Attackers can sub…

    ZKTeco ZKTeco ZKAccess Security System
  • High 8.8
    CVE-2016-20025

    ZKTeco ZKAccess Professional 3.5.3 Privilege Escalation via Insecure Permissions

    ZKTeco ZKAccess Professional 3.5.3 contains an insecure file permissions vulnerability that allows authenticated users to escalate privileges by modifying executable files. Attackers can leverage the Modify permission granted to the Authenticated Users group …

    ZKTeco ZKTeco ZKAccess Professional
  • High 7.0
    CVE-2025-54464

    Cleartext Storage Vulnerability in ZKTeco WL20

    This vulnerability exists in ZKTeco WL20 due to storage of admin and user credentials without encryption in the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and reverse engineer the binary data …

    ZKTeco WL20 Biometric Attendance System
  • High 7.3
    CVE-2024-13966

    ZKTeco BioTime default password

    ZKTeco BioTime allows unauthenticated attackers to enumerate usernames and log in as any user with a password unchanged from the default value '123456'. Users should change their passwords (located under the Attendance Settings tab as "Self-Password").

    ZKTeco BioTime
  • High 7.5
    CVE-2023-3942

    Multiple SQLi in ZkTeco-based OEM devices

    An 'SQL Injection' vulnerability, due to improper neutralization of special elements used in SQL commands, exists in ZKTeco-based OEM devices. This vulnerability allows an attacker to, in some cases, impersonate another user or perform unauthorized actions. I…

    ZKTeco ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0, Standalone service v. 2.1.6-20200907
  • High 7.5
    CVE-2023-3940

    Multiple arbitrary file reads in ZkTeco-based OEM devices

    Relative Path Traversal vulnerability in ZkTeco-based OEM devices allows an attacker to access any file on the system. This issue affects ZkTeco-based OEM devices (ZkTeco ProFace X, Smartec ST-FR043, Smartec ST-FR041ME and possibly others) with the ZAM170-NF-…

    ZKTeco ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0
  • High 8.3
    CVE-2023-4587

    Insecure direct object reference in ZKTeco ZEM800

    An IDOR vulnerability has been found in ZKTeco ZEM800 product affecting version 6.60. This vulnerability allows a local attacker to obtain registered user backup files or device configuration files over a local network or through a VPN server.

    ZKTeco ZEM800