Zkteco vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited Zkteco flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2023-38950 ZKTeco BioTime Path TraversalExploited since May 19, 2025 · CVSS 7.5

Latest high and critical flaws

• CVE-2026-8598 An undocumented configuration export port is accessible on some models of ZKTeco CCTV cameras.Critical 9.1 · May 20, 2026
• CVE-2016-20030 ZKTeco ZKBioSecurity 3.0 contains a user enumeration vulnerability that allows unauthenticated attackers to discover valid usernames by submitting partial charaCritical 9.3 · Mar 16, 2026
• CVE-2016-20026 ZKTeco ZKBioSecurity 3.0 contains hardcoded credentials in the bundled Apache Tomcat server that allow unauthenticated attackers to access the manager applicatiCritical 9.3 · Mar 16, 2026
• CVE-2016-20025 ZKTeco ZKAccess Professional 3.5.3 contains an insecure file permissions vulnerability that allows authenticated users to escalate privileges by modifying execuHigh 8.7 · Mar 16, 2026
• CVE-2016-20024 ZKTeco ZKTime.Net 3.0.1.6 contains an insecure file permissions vulnerability that allows unprivileged users to escalate privileges by modifying executable fileCritical 9.3 · Mar 16, 2026
• CVE-2025-54464 This vulnerability exists in ZKTeco WL20 due to storage of admin and user credentials without encryption in the device firmware.High 7 · Aug 13, 2025
• CVE-2024-24257 An issue in skteco.com Central Control Attendance Machine web management platform v.3.0 allows an attacker to obtain sensitive information via a crafted script High 7.5 · Jul 26, 2024
• CVE-2024-36526 ZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key.Critical 9.8 · Jul 9, 2024
• CVE-2024-35433 ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Incorrect Access Control.High 8.1 · May 30, 2024
• CVE-2024-35431 ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64.High 7.5 · May 30, 2024
• CVE-2024-35428 ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via BaseMediaFile.High 7.1 · May 30, 2024
• CVE-2024-35430 In ZKTeco ZKBio CVSecurity v6.1.1_R and earlier (fixed in 6.1.3_R) an authenticated user can bypass password checks while exporting data from the application.High 8.1 · May 30, 2024
• CVE-2023-3943 Stack-based Buffer Overflow vulnerability in ZkTeco-based OEM devices allows, in some cases, the execution of arbitrary code.Critical 10 · May 21, 2024
• CVE-2023-3942 An 'SQL Injection' vulnerability, due to improper neutralization of special elements used in SQL commands, exists in ZKTeco-based OEM devices.High 7.5 · May 21, 2024
• CVE-2023-3941 Relative Path Traversal vulnerability in ZkTeco-based OEM devices allows an attacker to write any file on the system with root privileges.Critical 10 · May 21, 2024
• CVE-2023-3940 Relative Path Traversal vulnerability in ZkTeco-based OEM devices allows an attacker to access any file on the system.High 7.5 · May 21, 2024
• CVE-2023-3939 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in ZkTeco-based OEM devices allows OS Command InjectiCritical 10 · May 21, 2024
• CVE-2023-51142 An issue in ZKTeco BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive information.High 7.5 · Apr 10, 2024
• CVE-2024-22988 ZKteco ZKBio WDMS before 9.0.2 Build 20250526 allows an attacker to download a database backup via the /files/backup/ component because the filename is based onCritical 9.8 · Feb 23, 2024
• CVE-2023-4587 An IDOR vulnerability has been found in ZKTeco ZEM800 product affecting version 6.60.High 8.3 · Sep 4, 2023
• CVE-2023-38952 Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not valHigh 7.5 · Aug 3, 2023
• CVE-2023-38951 ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the server via crafted rCritical 9.8 · Aug 3, 2023
• CVE-2023-38950 ZKTeco BioTime Path TraversalExploited · High 7.5 · Aug 3, 2023
• CVE-2023-38949 An issue in a hidden API in ZKTeco BioTime v8.5.5 allows unauthenticated attackers to arbitrarily reset the Administrator password via a crafted web request.High 7.5 · Aug 3, 2023
• CVE-2023-38956 A path traversal vulnerability in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload.High 7.5 · Aug 2, 2023