PT-2025-32979 · Zkteco · Zkteco Wl20

Published 2025-08-13 · Updated 2025-08-13 · CVE-2025-54464

Positive Technologies (AI Summary)

CVSS v4.0

7.0

High

Base vector

AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: ZKTeco WL20 (affected versions not specified)

Description: The vulnerability stems from the storage of administrator and user credentials without encryption within the device firmware. An attacker with physical access can exploit this by extracting the firmware and reverse engineering the binary data to access the unencrypted credentials.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2025-54464

Affected Products

Zkteco Wl20

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-54464 · Security Note
• https://zkteco.com/en/Security_Bulletinsibs/20 · Vendor Advisory
• https://t.me/cveNotify/132024 · Telegram Post
• https://cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2025-0172 · Note
• https://twitter.com/VulmonFeeds/status/1955623878618751124 · Twitter Post
• https://twitter.com/CVEnew/status/1955658259483779419 · Twitter Post