Zkbio Cvsecurity

zkbio_cvsecurity

Vendor: Zkteco • 8 CVEs

CVEs (8)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2025-45746 1Zkteco 1Zkbio Cvsecurity Jun 17, 2026 May 13, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 In ZKT ZKBio CVSecurity 6.4.1_R an unauthenticated attacker can craft JWT token using the hardcoded secret to authenticate to the service console. NOTE: the Supplier disputes the significance of this report because the s...Show more In ZKT ZKBio CVSecurity 6.4.1_R an unauthenticated attacker can craft JWT token using the hardcoded secret to authenticate to the service console. NOTE: the Supplier disputes the significance of this report because the service console is typically only accessible from a local area network, and because access to the service console does not result in login access or data access in the context of the application software platform.Show less
CVE-2024-36526 1Zkteco 1Zkbio Cvsecurity Jun 17, 2026 Jul 9, 2024 N/A· v4 9.8 CRITICAL· v3 N/A· v2 ZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key.
CVE-2024-35433 1Zkteco 1Zkbio Cvsecurity Jun 17, 2026 May 30, 2024 N/A· v4 8.1 HIGH· v3 N/A· v2 ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Incorrect Access Control. An authenticated user, without the permissions of managing users, can create a new admin user.
CVE-2024-35431 1Zkteco 1Zkbio Cvsecurity Jun 17, 2026 May 30, 2024 N/A· v4 7.5 HIGH· v3 N/A· v2 ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user can download local files from the server. NOTE: Third parties have indicated other versions are also vulnerable...Show more ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user can download local files from the server. NOTE: Third parties have indicated other versions are also vulnerable including up to 6.4.1.Show less
CVE-2024-35429 1Zkteco 1Zkbio Cvsecurity Jun 17, 2026 May 30, 2024 N/A· v4 6.5 MEDIUM· v3 N/A· v2 ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via eventRecord.
CVE-2024-35428 1Zkteco 1Zkbio Cvsecurity Jun 17, 2026 May 30, 2024 N/A· v4 7.1 HIGH· v3 N/A· v2 ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via BaseMediaFile. An authenticated user can delete local files from the server which can lead to DoS.
CVE-2024-35432 1Zkteco 1Zkbio Cvsecurity Jun 17, 2026 May 30, 2024 N/A· v4 6.1 MEDIUM· v3 N/A· v2 ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Cross Site Scripting (XSS) via an Audio File. An authenticated user can injection malicious JavaScript code to trigger a Cross Site Scripting.
CVE-2024-35430 1Zkteco 1Zkbio Cvsecurity Jun 17, 2026 May 30, 2024 N/A· v4 8.1 HIGH· v3 N/A· v2 In ZKTeco ZKBio CVSecurity v6.1.1_R and earlier (fixed in 6.1.3_R) an authenticated user can bypass password checks while exporting data from the application.