ZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key.
The manufacturer placed a hardcoded cryptographic key directly in the application code. An attacker who gains access to binary files or application code can read this key and use it to decrypt protected data, sign fake tokens, or bypass authentication mechanisms. Because the key is identical in all product installations, a successful attack on one installation provides the tools to attack any other.
An attacker can gain full access to protected system data, compromise data integrity, or deny system availability — without needing to possess any credentials.
Apply patches available from the manufacturer according to the references. The manufacturer provides installation files at https://zkteco.eu/downloads/zkbio-cvsecurity-installation-files. Until the update is applied, restrict network access to the system only to trusted hosts.
ZKTeco ZKBio CVSecurity v6.1.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HZkteco Zkbio Cvsecurity
APPZkteco6.1.1
Related vulnerabilities
ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user ca...
In ZKTeco ZKBio CVSecurity v6.1.1_R and earlier (fixed in 6.1.3_R) an authenticated user can bypass password c...
ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via BaseMediaFile. An authenticated user ca...
ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Incorrect Access Control. An authenticated user, without the pe...
In ZKT ZKBio CVSecurity 6.4.1_R an unauthenticated attacker can craft JWT token using the hardcoded secret to ...