Zkteco Zkbio Cvsecurity — known CVE vulnerabilities

Every CVE whose affected-product data names Zkteco Zkbio Cvsecurity, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (8)

• CVE-2024-36526 — CVSS 9.8 (critical): ZKTeco ZKBio CVSecurity v6.1.1 was discovered to contain a hardcoded cryptographic key.
• CVE-2024-35433 — CVSS 8.1 (high): ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Incorrect Access Control. An authenticated user, without the permissions of managing users…
• CVE-2024-35430 — CVSS 8.1 (high): In ZKTeco ZKBio CVSecurity v6.1.1_R and earlier (fixed in 6.1.3_R) an authenticated user can bypass password checks while exporting data…
• CVE-2024-35431 — CVSS 7.5 (high): ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user can download local files from…
• CVE-2024-35428 — CVSS 7.1 (high): ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via BaseMediaFile. An authenticated user can delete local files from the…
• CVE-2025-45746 — CVSS 6.5 (medium): In ZKT ZKBio CVSecurity 6.4.1_R an unauthenticated attacker can craft JWT token using the hardcoded secret to authenticate to the service…
• CVE-2024-35429 — CVSS 6.5 (medium): ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via eventRecord.
• CVE-2024-35432 — CVSS 6.1 (medium): ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Cross Site Scripting (XSS) via an Audio File. An authenticated user can injection malicious…