Description
ZKTeco BioTime allows unauthenticated attackers to enumerate usernames and log in as any user with a password unchanged from the default value '123456'. Users should change their passwords (located under the Attendance Settings tab as "Self-Password").
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ZKTeco | BioTime | — | — |
Advisories 1
- VA-25-148-01 ZKTeco BioTime multiple vulnerabilities CISA ICS & IT advisories · May 28, 2025