PT-2022-26677 · Zkteco · Zmm200+9

Published 2022-12-25 · Updated 2023-08-08 · CVE-2022-42953

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ZKTeco ZEM500-510-560-760 versions prior to 8.88 ZKTeco ZEM600-800 versions prior to 8.88 ZKTeco ZEM720 versions prior to 8.88 ZKTeco ZMM200-220-210 versions prior to 15.00

Description Certain ZKTeco products allow access to sensitive information via direct requests for the "form/DataApp?style=1" and "form/DataApp?style=0" URLs.

Recommendations For ZKTeco ZEM500-510-560-760 versions prior to 8.88, update to firmware version 8.88. For ZKTeco ZEM600-800 versions prior to 8.88, update to firmware version 8.88. For ZKTeco ZEM720 versions prior to 8.88, update to firmware version 8.88. For ZKTeco ZMM200-220-210 versions prior to 15.00, update to firmware version 15.00.

Exploit

Fix

Weakness Enumeration

CWE-425

Related Identifiers

CVE-2022-42953

Affected Products

Zem500

Zem510

Zem560

Zem600

Zem720

Zem760

Zem800

Zmm200

Zmm210

Zmm220

References · 6

• 🔥 https://redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses · Exploit
• 🔥 https://seclists.org/fulldisclosure/2022/Oct/23 · Exploit
• 🔥 https://exploit-db.com/exploits/51112 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-42953 · Security Note
• https://osv.dev/vulnerability/CVE-2022-42953 · Vendor Advisory
• https://t.me/cibsecurity/55297 · Telegram Post