MEDIUM🇵🇱 Wersja polska

CVE-2025-45746

CVSS 6.5v3.1pub. 2025-05-13upd. 2025-05-21

In ZKT ZKBio CVSecurity 6.4.1_R an unauthenticated attacker can craft JWT token using the hardcoded secret to authenticate to the service console. NOTE: the Supplier disputes the significance of this report because the service console is typically only accessible from a local area network, and because access to the service console does not result in login access or data access in the context of the application software platform.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

  • Zkteco Zkbio Cvsecurity

    APP
    Zkteco
    6.4.1_r
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2024-36526CRITICAL9.8PL ✓ten sam produkt

ZKTeco ZKBio CVSecurity — hardcoded klucz kryptograficzny

CVE-2024-35430HIGH8.1ten sam produkt

In ZKTeco ZKBio CVSecurity v6.1.1_R and earlier (fixed in 6.1.3_R) an authenticated user can bypass password c...

CVE-2024-35428HIGH7.1ten sam produkt

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via BaseMediaFile. An authenticated user ca...

CVE-2024-35431HIGH7.5ten sam produkt

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user ca...

CVE-2024-35433HIGH8.1ten sam produkt

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Incorrect Access Control. An authenticated user, without the pe...