Vulnerability · Published Dec 23, 2025 · Assigned by VulnCheck
CVE-2021-47722Zucchetti Axess CLOKI Access Control 1.64 Cross-Site Request Forgery
Low 3.5
In plain English
A low-severity cross-site request forgery in Zucchetti Axess CLOKI Access Control from Axesstmc. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).
Severity (CVSS 3.1)3.5Low
Exploit odds (30 days)0.2%top 90.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Zucchetti Axess CLOKI Access Control 1.64 contains a cross-site request forgery vulnerability that allows attackers to manipulate access control settings without user interaction. Attackers can craft malicious web pages with hidden forms to disable or modify access control parameters by tricking authenticated users into loading the page.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Axesstmc | Zucchetti Axess CLOKI Access Control | 1.64 |
Weakness: CWE-352 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
References
- ExploitDB-50595 exploit
- Product Web Page product
- Zero Science Lab Disclosure (ZSL-2021-5689) third-party-advisory
- VulnCheck Advisory: Zucchetti Axess CLOKI Access Control 1.64 Cross-Site Request Forgery third-party-advisory