ZKBio CVSecurity vulnerabilities
5 known vulnerabilities in ZKBio CVSecurity from ZkTeco. 5 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.8 Critical severity
ZKBio CVSecurity: Use of Hard-coded Credentials
In ZKT ZKBio CVSecurity 6.4.1_R an unauthenticated attacker can craft JWT token using the hardcoded secret to authenticate to the service console. NOTE: the Supplier disputes the significance of this report because the service console is typically only accessi
- 8.1 High severity
zkbio_cvsecurity: Improper Access Control
ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Incorrect Access Control. An authenticated user, without the permissions of managing users, can create a new admin user.
- 7.5 High severity
zkbio_cvsecurity: Path Traversal: 'dir....filename'
ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user can download local files from the server. NOTE: Third parties have indicated other versions are also vulnerable including up to 6.4.1.
- 7.1 High severity
Zkbio Cvsecurity: Improper Limitation of a Pathname to a Restricted Directory
ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via BaseMediaFile. An authenticated user can delete local files from the server which can lead to DoS.
- 8.1 High severity
zkbio_cvsecurity: Improper Privilege Management
In ZKTeco ZKBio CVSecurity v6.1.1_R and earlier (fixed in 6.1.3_R) an authenticated user can bypass password checks while exporting data from the application.