ZK
Vendor
Zkteco
93
CVEs
1
On KEV
5
New 30D
Products
BI9.8
BioTime
ZKTeco
18 CVEs1 on KEV5 new
ZC9.8
ZKBio CVSecurity
ZKTeco
8 CVEs0 on KEV0 new
F710.0
Facedepot 7b
Zkteco
6 CVEs0 on KEV0 new
SS10.0
Smartec ST Fr041me
Zkteco
6 CVEs0 on KEV0 new
SS10.0
Smartec ST Fr043
Zkteco
6 CVEs0 on KEV0 new
ZV8.8
Zkbiosecurity V5000
Zkteco
5 CVEs0 on KEV0 new
ZO10.0
ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0
ZkTeco
5 CVEs0 on KEV0 new
ZW8.8
Zktime Web
Zkteco
5 CVEs0 on KEV0 new
BI9.8
Bioaccess Ivs
Zkteco
4 CVEs0 on KEV0 new
ZC3.5
ZKBio CVSecurity V5000
ZKTeco
3 CVEs0 on KEV0 new
F79.8
Facedepot 7b Firmware
Zkteco
2 CVEs0 on KEV0 new
ZF7.5
Zem800 Firmware
Zkteco
2 CVEs0 on KEV0 new
ZS9.8
Zkbiosecurity Server
Zkteco
2 CVEs0 on KEV0 new
AD4.8
Automatic Data Master Server
Zkteco
1 CVEs0 on KEV0 new
IV4.3
iClock v3.1-168
ZKteco
1 CVEs0 on KEV0 new
SS9.1
SSC335-GC2063-Face-0b77 Solution Camera
ZKTeco
1 CVEs0 on KEV0 new
WD5.4
Wdms
Zkteco
1 CVEs0 on KEV0 new
WP5.4
Wdms Pro
Zkteco
1 CVEs0 on KEV0 new
ZF7.5
Zem500 Firmware
Zkteco
1 CVEs0 on KEV0 new
ZF7.5
Zem510 Firmware
Zkteco
1 CVEs0 on KEV0 new
ZF7.5
Zem560 Firmware
Zkteco
1 CVEs0 on KEV0 new
ZF7.5
Zem600 Firmware
Zkteco
1 CVEs0 on KEV0 new
ZF7.5
Zem720 Firmware
Zkteco
1 CVEs0 on KEV0 new
ZF7.5
Zem760 Firmware
Zkteco
1 CVEs0 on KEV0 new
ZE5.5
ZEM800
ZKTeco
1 CVEs0 on KEV0 new
ZA5.4
ZKBio Access IVS
ZKTeco
1 CVEs0 on KEV0 new
ZM7.5
ZKBio Media
ZKTeco
1 CVEs0 on KEV0 new
ZT3.7
ZKBio Time
ZKTeco
1 CVEs0 on KEV0 new
ZW9.8
Zkbio Wdms
Zkteco
1 CVEs0 on KEV0 new
ZO7.5
ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0, Standalone service v. 2.1.6-20200907
ZkTeco
1 CVEs0 on KEV0 new
ZK7.5
Zktime
Zkteco
1 CVEs0 on KEV0 new
ZF7.5
Zmm200 Firmware
Zkteco
1 CVEs0 on KEV0 new
ZF7.5
Zmm210 Firmware
Zkteco
1 CVEs0 on KEV0 new
ZF7.5
Zmm220 Firmware
Zkteco
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-108798 | BI BioTime ZKTeco | 7.3 | Oct 12 | ZKTeco BioTime hard-coded key |
| CVE-2026-108797 | BI BioTime ZKTeco | 4.3 | Oct 12 | ZKTeco BioTime Employee REST API employees authorization |
| CVE-2026-108796 | BI BioTime ZKTeco | 4.3 | Oct 12 | ZKTeco BioTime Biometric Data Endpoint finger_data authorization |
| CVE-2026-108795 | BI BioTime ZKTeco | 4.3 | Oct 12 | ZKTeco BioTime System Settings API systemSettings access control |
| CVE-2026-108794 | BI BioTime ZKTeco | 6.3 | Oct 12 | ZKTeco BioTime Database Migration Functionality db_migrate_setting sql injection |
| CVE-2026-8598 | SS SSC335-GC2063-Face-0b77 Solution Camera ZKTeco | 9.1 | May 20 | Unauthenticated Export Service in ZKTeco CCTV Cameras |
| CVE-2025-15128 | BI BioTime ZKTeco | 5.3 | Dec 28 | ZKTeco BioTime Endpoint safe_setting credentials storage |
| CVE-2024-13966 | BI BioTime ZKTeco | 7.3 | May 27 | ZKTeco BioTime default password |
| CVE-2025-45746 | ZC ZKBio CVSecurity ZKTeco | 9.8 | May 13 | In ZKT ZKBio CVSecurity 6.4.1_R an unauthenticated attacker can craft JWT token using the hardcoded secret to authenticate to the service console |
| CVE-2024-11049 | ZT ZKBio Time ZKTeco | 3.7 | Nov 10 | ZKTeco ZKBio Time Image File photo direct request |
| CVE-2024-45250 | IV iClock v3.1-168 ZKteco | 4.3 | Oct 6 | ZKteco – CWE 200 Exposure of Sensitive Information to an Unauthorized Actor |
| CVE-2023-51157 | WD Wdms Zkteco | 5.4 | Sep 25 | Cross Site Scripting vulnerability in ZKTeco WDMS v.5.1.3 Pro allows a remote attacker to execute arbitrary code and obtain sensitive information via a crafted script to the Emp… |
| CVE-2024-24257 | ZW Zktime Web Zkteco | 7.5 | Jul 26 | An issue in skteco.com Central Control Attendance Machine web management platform v.3.0 allows an attacker to obtain sensitive information via a crafted script to the csl/user… |
| CVE-2024-36526 | ZC Zkbio Cvsecurity Zkteco | 9.8 | Jul 9 | ZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key |
| CVE-2024-6523 | BI BioTime ZKTeco | 5.4 | Jul 5 | ZKTeco BioTime system-group-add cross site scripting |
| CVE-2024-6344 | ZC ZKBio CVSecurity V5000 ZKTeco | 2.4 | Jun 26 | ZKTeco ZKBio CVSecurity V5000 Push Configuration Section cross site scripting |
| CVE-2024-6006 | ZC ZKBio CVSecurity V5000 ZKTeco | 3.5 | Jun 15 | ZKTeco ZKBio CVSecurity V5000 Summer Schedule cross site scripting |
| CVE-2024-6005 | ZC ZKBio CVSecurity V5000 ZKTeco | 3.5 | Jun 15 | ZKTeco ZKBio CVSecurity V5000 Department Section cross site scripting |
| CVE-2024-35433 | ZC Zkbio Cvsecurity Zkteco | 8.1 | May 30 | ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Incorrect Access Control |
| CVE-2024-35428 | ZC Zkbio Cvsecurity Zkteco | 7.1 | May 30 | ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via BaseMediaFile |
| CVE-2024-35429 | ZC Zkbio Cvsecurity Zkteco | 6.5 | May 30 | ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via eventRecord |
| CVE-2024-35431 | ZC Zkbio Cvsecurity Zkteco | 7.5 | May 30 | ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64 |
| CVE-2024-35432 | ZC Zkbio Cvsecurity Zkteco | 6.1 | May 30 | ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Cross Site Scripting (XSS) via an Audio File |
| CVE-2024-35430 | ZC Zkbio Cvsecurity Zkteco | 8.1 | May 30 | In ZKTeco ZKBio CVSecurity v6.1.1_R and earlier (fixed in 6.1.3_R) an authenticated user can bypass password checks while exporting data from the application |
| CVE-2023-3943 | ZO ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0 ZkTeco | 10.0 | May 21 | Multiple buffer overflow in ZkTeco-based OEM devices |
| CVE-2023-3942 | ZO ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0, Standalone service v. 2.1.6-20200907 ZkTeco | 7.5 | May 21 | Multiple SQLi in ZkTeco-based OEM devices |
| CVE-2023-3941 | ZO ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0 ZkTeco | 10.0 | May 21 | Multiple arbitrary file writes in ZkTeco-based OEM devices |
| CVE-2023-3940 | ZO ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0 ZkTeco | 7.5 | May 21 | Multiple arbitrary file reads in ZkTeco-based OEM devices |
| CVE-2023-3939 | ZO ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0 ZkTeco | 10.0 | May 21 | Multiple command injection in ZkTeco-based OEM devices |
| CVE-2023-3938 | ZO ZkTeco-based OEM devices with firmware ZAM170-NF-1.8.25-7354-Ver1.0.0 ZkTeco | 4.6 | May 21 | Bypassing ZkTeco-based OEM devices/ZKTeco biometric authentication system via SQLi in QR code |
| CVE-2023-51141 | BI Biotime Zkteco | 6.5 | Mar 21 | An issue in ZKTeko BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive information via the Authentication & Authorization component |
| CVE-2023-51142 | BI Biotime Zkteco | 7.5 | Mar 21 | An issue in ZKTeco BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive information |
| CVE-2024-2318 | ZM ZKBio Media ZKTeco | 7.5 | Mar 8 | ZKTeco ZKBio Media Service Port 9999 download path traversal |
| CVE-2024-22988 | ZW Zkbio Wdms Zkteco | 9.8 | Feb 23 | ZKteco ZKBio WDMS before 9.0.2 Build 20250526 allows an attacker to download a database backup via the /files/backup/ component because the filename is based on a predictable… |
| CVE-2024-1706 | ZA ZKBio Access IVS ZKTeco | 5.4 | Feb 21 | ZKTeco ZKBio Access IVS Department Name Search Bar cross site scripting |
| CVE-2023-4587 | ZE ZEM800 ZKTeco | 5.5 | Sep 4 | Insecure direct object reference in ZKTeco ZEM800 |
| CVE-2023-38952 | BI Biotime Zkteco | 7.5 | Aug 3 | Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that session ids are not validated for the type… |
| CVE-2023-38951 | BI Biotime Zkteco | 9.8 | Aug 3 | ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the server via crafted requests to… |
| CVE-2023-38949 | BI Biotime Zkteco | 7.5 | Aug 3 | An issue in a hidden API in ZKTeco BioTime v8.5.5 allows unauthenticated attackers to arbitrarily reset the Administrator password via a crafted web request |
| CVE-2023-38958 | BI Bioaccess Ivs Zkteco | 5.3 | Aug 3 | An access control issue in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to arbitrarily close and open the doors managed by the platform remotely via sending a… |
| CVE-2023-38956 | BI Bioaccess Ivs Zkteco | 7.5 | Aug 3 | A path traversal vulnerability in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload |
| CVE-2023-38955 | BI Bioaccess Ivs Zkteco | 7.5 | Aug 3 | ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to obtain sensitive information about all managed devices, including their IP addresses and device names |
| CVE-2023-38954 | BI Bioaccess Ivs Zkteco | 9.8 | Aug 3 | ZKTeco BioAccess IVS v3.3.1 was discovered to contain a SQL injection vulnerability |
| CVE-2023-38950 In wildKEV | BI Biotime Zkteco | 7.5 | Aug 3 | ZKTeco BioTime Path Traversal Vulnerability |
| CVE-2022-42953 | ZF Zem760 Firmware Zkteco | 7.5 | Dec 25 | Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive information via direct requests for the form/DataApp?style=1 and… |
| CVE-2022-44213 | AD Automatic Data Master Server Zkteco | 4.8 | Dec 9 | ZKTeco Xiamen Information Technology ZKBio ECO ADMS <=3.1-164 is vulnerable to Cross Site Scripting (XSS) |
| CVE-2021-39434 | ZK Zktime Zkteco | 7.5 | Dec 5 | A default username and password for an administrator account was discovered in ZKTeco ZKTime 10.0 through 11.1.0, builds 20180901, 20190510.1, 20200309.3, 20200930, 20201231, and… |
| CVE-2022-38803 | BI Biotime Zkteco | 6.8 | Nov 30 | Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via Leave, overtime, Manual log |
| CVE-2022-38802 | BI Biotime Zkteco | 6.2 | Nov 30 | Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via resign, private message, manual log, time interval, attshift, and holiday |
| CVE-2022-38801 | BI Biotime Zkteco | 5.4 | Nov 30 | In Zkteco BioTime < 8.5.3 Build:20200816.447, an employee can hijack an administrator session and cookies using blind cross-site scripting |
| CVE-2022-30515 | BI Biotime Zkteco | 5.3 | Nov 8 | ZKTeco BioTime 8.5.4 is missing authentication on folders containing employee photos, allowing an attacker to view them through filename enumeration |
| CVE-2022-36635 | ZV Zkbiosecurity V5000 Zkteco | 8.8 | Oct 7 | ZKteco ZKBioSecurity V5000 4.1.3 was discovered to contain a SQL injection vulnerability via the component /baseOpLog.do |
| CVE-2022-36634 | ZV Zkbiosecurity V5000 Zkteco | 8.8 | Oct 7 | An access control issue in ZKTeco ZKBioSecurity V5000 3.0.5_r allows attackers to arbitrarily create admin users via a crafted HTTP request |
| CVE-2020-17474 | F7 Facedepot 7b Firmware Zkteco | 9.8 | Aug 14 | A token-reuse vulnerability in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723 allows an attacker to create arbitrary new users, elevate users to… |
| CVE-2020-17473 | F7 Facedepot 7b Firmware Zkteco | 5.9 | Aug 14 | Lack of mutual authentication in ZKTeco FaceDepot 7B 1.0.213 and ZKBiosecurity Server 1.0.0_20190723 allows an attacker to obtain a long-lasting token by impersonating the server |
| CVE-2017-17057 | ZW Zktime Web Zkteco | 6.1 | Dec 4 | There is a reflected XSS vulnerability in ZKTime Web 2.0.1.12280 |
| CVE-2017-17056 | ZW Zktime Web Zkteco | 8.8 | Dec 4 | The ZKTime Web Software 2.0.1.12280 allows the Administrator to elevate the privileges of the application user using a 'password_change()' function of the Modify Password… |
| CVE-2017-13129 | ZW Zktime Web Zkteco | 8.0 | Sep 26 | Cross-site request forgery (CSRF) vulnerability in ZKTeco ZKTime Web 2.0.1.12280 allows remote authenticated users to hijack the authentication of administrators for requests that… |
| CVE-2017-14680 | ZW Zktime Web Zkteco | 7.5 | Sep 21 | ZKTeco ZKTime Web 2.0.1.12280 allows remote attackers to obtain sensitive employee metadata via a direct request for a PDF document |