CVE-2021-39434

Published: Dec 6, 2022Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

A default username and password for an administrator account was discovered in ZKTeco ZKTime 10.0 through 11.1.0, builds 20180901, 20190510.1, 20200309.3, 20200930, 20201231, and 20210220.

Affected (8)

Products: Zkteco: Zktime

Zkteco

1 product

Zktime

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Zkteco Zktime	10.0 ≤ version ≤ 11.1.0
Zkteco Zktime	Version 11.1.0
Zkteco Zktime	Version 11.1.0 20180901
Zkteco Zktime	Version 11.1.0 20190510.1
Zkteco Zktime	Version 11.1.0 20200309.3
Zkteco Zktime	Version 11.1.0 20200930
Zkteco Zktime	Version 11.1.0 20201231
Zkteco Zktime	Version 11.1.0 20210220

Related CWEs

CWE-521

Weak Password Requirements

The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.

References (2)

https://www.cnvd.org.cn/flaw/show/CNVD-2018-26041

Source: cve@mitre.org

Third Party Advisory

https://www.cnvd.org.cn/flaw/show/CNVD-2018-26041

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.