Log in Start free

ZKTeco

Products

ProductCVEsExploitedLatest
BioTime8–Oct 12, 2026
ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.05–May 21, 2024
ZKBio CVSecurity V50003–Jun 26, 2024
ZEM8001–Sep 4, 2023
ZKBio Access IVS1–Feb 21, 2024
ZKBio CVSecurity1–May 13, 2025
ZKBio Media1–Mar 8, 2024
ZKBio Time1–Nov 10, 2024
ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0, Standalone service v. 2.1.6-202009071–May 21, 2024
iClock v3.1-1681–Oct 6, 2024
SSC335-GC2063-Face-0b77 Solution Camera1–May 20, 2026

Exploited and recent CVEs

  • CVE-2026-108798 High 7.3 ZKTeco BioTime hard-coded key 0.3%
  • CVE-2026-108797 Medium 4.3 ZKTeco BioTime Employee REST API employees authorization 0.3%
  • CVE-2026-108796 Medium 4.3 ZKTeco BioTime Biometric Data Endpoint finger_data authorization 0.2%
  • CVE-2026-108795 Medium 4.3 ZKTeco BioTime System Settings API systemSettings access control 0.3%
  • CVE-2026-108794 Medium 6.3 ZKTeco BioTime Database Migration Functionality db_migrate_setting sql injection 0.2%
  • CVE-2026-8598 Critical 9.1 Unauthenticated Export Service in ZKTeco CCTV Cameras 0.5%
  • CVE-2025-15128 Medium 5.3 ZKTeco BioTime Endpoint safe_setting credentials storage 0.3%
  • CVE-2024-13966 High 7.3 ZKTeco BioTime default password 0.4%
  • CVE-2025-45746 Medium 6.5 In ZKT ZKBio CVSecurity 6.4.1_R an unauthenticated attacker can craft JWT token using the hardcoded secret to authenticate to the service console. NOTE: the Supplier disputes the significance of this 0.4%
  • CVE-2024-11049 Low 3.7 ZKTeco ZKBio Time Image File photo direct request 0.4%
  • CVE-2024-45250 Medium 4.3 ZKteco – CWE 200 Exposure of Sensitive Information to an Unauthorized Actor 0.3%
  • CVE-2024-6523 Low 3.5 ZKTeco BioTime system-group-add cross site scripting 0.5%
  • CVE-2024-6344 Low 2.4 ZKTeco ZKBio CVSecurity V5000 Push Configuration Section cross site scripting 0.4%
  • CVE-2024-6006 Low 3.5 ZKTeco ZKBio CVSecurity V5000 Summer Schedule cross site scripting 0.4%
  • CVE-2024-6005 Low 3.5 ZKTeco ZKBio CVSecurity V5000 Department Section cross site scripting 0.4%
  • CVE-2023-3943 Critical 10.0 Multiple buffer overflow in ZkTeco-based OEM devices 0.9%
  • CVE-2023-3942 High 7.5 Multiple SQLi in ZkTeco-based OEM devices 0.6%
  • CVE-2023-3941 Critical 10.0 Multiple arbitrary file writes in ZkTeco-based OEM devices 0.9%
  • CVE-2023-3940 High 7.5 Multiple arbitrary file reads in ZkTeco-based OEM devices 0.8%
  • CVE-2023-3939 Critical 10.0 Multiple command injection in ZkTeco-based OEM devices 1.3%
  • CVE-2023-3938 Medium 4.6 Bypassing ZkTeco-based OEM devices/ZKTeco biometric authentication system via SQLi in QR code 0.4%
  • CVE-2024-2318 Medium 4.3 ZKTeco ZKBio Media Service Port 9999 download path traversal 0.9%
  • CVE-2024-1706 Low 3.5 ZKTeco ZKBio Access IVS Department Name Search Bar cross site scripting 0.4%
  • CVE-2023-4587 High 8.3 Insecure direct object reference in ZKTeco ZEM800 0.2%